Security Disclosure(blog.railway.com)
590 points by passenger 4 days ago | 334 comments
tl;dr: Railway detected unauthorized access to systems storing customer environment variables, with some encrypted secrets potentially decrypted by attackers. The breach appears part of a broader campaign targeting platform companies to compromise AI inference providers. All users are urged to rotate API keys, database credentials, and registry credentials immediately; deployments are paused during the investigation.
HN Discussion:
  • ↓Rotating keys as advised is impossible or harmful because deployments are paused
  • ↓Railway communicated too slowly and users learned via Discord rather than official channels
  • ↑Confirmation that attackers accessed decrypted environment variables and used stolen keys
  • •Curiosity about how attackers monetize stolen AI API keys
  • ↑This breach is part of a broader wave of security incidents hitting the industry