Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

Railway, a Platform-as-a-Service provider, disclosed an incident where an unauthorized third party may have accessed encrypted customer environment variables and, in some cases, obtained decrypted contents. The breach potentially allowed attackers to extract sensitive data such as API keys, database credentials, and cryptocurrency wallet private keys, leading to at least one confirmed cryptocurrency theft. The company urges affected customers to rotate credentials and has taken internal measures including rotating bucket credentials and invalidating API tokens. The incident is suspected to be part of a broader campaign targeting cloud platforms to enable 'LLMjacking'—abusing AI inference resources at the victim's expense.

AI-extracted · verify before operational use