Railway urges users to rotate secret keys after cyberattack — TechCrunch

Developer platform Railway has confirmed a cyberattack during which attackers may have gained access to some customers’ secret data. The company urged all users to revoke and rotate API keys and access keys for cloud services, TechCrunch reports.

Access to environment variables

Railway said unidentified hackers may have gained access to encrypted environment variables and, in some cases, to their decrypted contents. Such variables typically contain passwords and API keys that developers’ applications use to access other services, including cloud data storage and databases.

Attackers who obtained such secret data could potentially log in to linked services and access data on behalf of a legitimate user. Railway’s preliminary analysis indicates that the incident may have affected only some users, but the company recommended that all customers replace their keys to prevent their possible use.

More current news is available on the UA.News Telegram channel Telegram.

Investigation of the incident

Railway suspended customer project deployments while the investigation is underway. According to TechCrunch, this effectively froze customers’ websites and applications. The company did not say exactly how many users were affected, what caused the incident, or which Railway systems may have been compromised.

Railway believes the breach was likely part of a broader attack on platforms aimed at compromising AI inference providers. Earlier this week, the open-source coding tool OpenCode also reported the compromise of customers’ secret data. The company said attackers obtained API keys and other secrets belonging to more than 1% of its customers and linked the incident to an attempt to extract sensitive information from artificial intelligence models.