Cloud hosting platform Railway disclosed a security breach in which attackers may have accessed customers' encrypted environment variables and, in some cases, obtained their decrypted contents, the company said, as it urged users to rotate every secret stored on the platform.
Railway said it linked the intrusion to a broader pattern of attacks targeting AI inference providers specifically, suggesting the attackers were after AI provider API keys. The company notified affected inference providers directly and advised them to revoke all their keys as a precaution. Railway paused all deployments on the platform while it investigates, and said its own recovery steps include cancelling its API tokens and resetting keys across every storage bucket it operates.
Part of a wider pattern
Railway's disclosure follows similar incidents at two other developer platforms in recent weeks. Cloud platform Zeabur reported that an attacker read more than 3.2 million environment-variable records in a mid-October breach, and developer tool OpenCode reported a comparable intrusion around the same time. None of the three incidents has been formally confirmed as linked to a single attacker or campaign, but security researchers have pointed to the shared targeting of environment-variable stores as evidence of a coordinated effort to harvest credentials across the developer tooling ecosystem rather than isolated, unrelated break-ins.
Railway's own estimate suggests a small fraction of its workspaces were affected, though it has not ruled out a larger scope as the investigation continues. The company's advice to customers is unusually blunt: treat every secret stored on the platform as potentially compromised and rotate it, rather than waiting for confirmation that a specific key was accessed.
