Cloud Platform Railway Breached; Sensitive Customer Variables and AI Keys Decrypted
Railway reported a breach where attackers decrypted environment variables affecting up to 100,000 workspaces (1.85%). Attackers targeted AI vendor API keys, likely for model distillation. Exposed keys are being revoked.
Railway reported an intrusion starting Oct 20 where attackers gained CI credentials to decrypt customer environment variables, potentially affecting up to 100,000 workspaces (1.85%). Logs indicate attackers searched for AI vendor API keys, suspected for model distillation. Railway requested providers like OpenAI and Anthropic to revoke keys and migrated build infrastructure to a single-tenant architecture.
Key takeaways
- Attackers used CI credentials to decrypt customer variables, impacting up to 100,000 workspaces (1.85%) while seeking AI API keys.
- Railway requested vendors like OpenAI and Anthropic to revoke keys and urged users registered before Oct 21 to rotate credentials.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.