Railway build environment breached; environment variables of up to about 100,000 workspaces may have been decrypted and AI keys abused

Railway said the attack ran from October 20 to 22 and aimed to obtain AI provider API keys for distillation attacks, interrupting builds and deployments ^[2]. Its final report says the attacker chained multiple exploits and moved laterally, with environment variables of at most 1.85% (about 100,000) of workspaces possibly decrypted, linked-account tokens of 1,852 users exposed and unauthorized spend on stolen keys estimated at about $740,000 ^[1]. Railway recommends that all customers who signed up before October 21 rotate the keys stored on Railway ^[2][3].

Industries mainly affected: Technology

1. Customers who signed up before October 21 should rotate all keys stored on Railway ^[2].
2. Revoke and rotate cloud and AI service API keys so attackers cannot abuse them ^[3].