Railway, a cloud platform used for application deployments, has paused all deployments following the detection of unusual activity in systems that store customer environment variables. The company disclosed that an unauthorized third party may have accessed encrypted environment variables and obtained the decrypted contents of some of them.

Environment variables commonly hold sensitive configuration data required for applications to operate, including API keys, database credentials and private registry credentials. Railway stated that its initial analysis indicates the impact may be limited to a subset of users, though the full scope of the incident remains under review.

Incident Detection and Immediate Response

Suspicious activity was identified on October 21 in the systems responsible for storing customer environment variables. Railway responded by suspending all deployments while it investigates. The company has not disclosed the method of unauthorized access, the precise number of accounts affected or the specific mechanisms that allowed encrypted values to become readable.

Railway has indicated that the incident appears connected to a recent series of attacks aimed at platform companies, with the apparent objective of reaching AI inference service providers. The firm has notified upstream providers and requested that they proactively revoke keys, without identifying the specific providers involved.

As the investigation proceeds, Railway plans to contact confirmed affected customers directly by email. Updates continue to be posted on its status page.

Credential Rotation Guidance for All Users

Railway has advised every customer, regardless of confirmed impact, to treat all secrets stored on the platform as potentially compromised. Users are instructed to immediately rotate every environment variable, including API keys, database credentials and private registry credentials. Service logs should also be reviewed for any unusual activity during and after the incident window.

Additional guidance was issued for customers using Google Cloud service-account keys. Railway recommended disabling any suspect keys, replacing the credentials, redeploying services and examining cloud audit logs as well as billing records for signs of unauthorized resource creation, permission changes or unexpected charges. Because service-account keys do not expire by default and can remain usable until disabled, the company further advised disabling the entire service account to cut off access immediately. Short-lived tokens issued before a key is disabled may remain valid for up to one hour.

Deployment Restoration by Plan Tier

Deployments were restored on a staggered schedule according to plan tier. Enterprise builds resumed at 11:32 p.m. ET on October 21. By 12:14 p.m. ET on October 22, Pro and Enterprise deployments were operating at normal speed, although some builds failed shortly after starting. Restoration efforts for Hobby, Free and Trial plans continued at that time. Redeploy functionality remained limited in earlier updates, with users directed to deploy the latest commit through alternative controls.

The temporary suspension of deployments has imposed operational delays on teams with active release schedules, preventing the rollout of new application versions until builds are fully restored.

The exposure of environment variables carries particular relevance for teams that store production credentials on the platform, as compromised keys could enable unauthorized access to connected services.