Railway urges users to reset credentials after potential decryption of customer environment variables

Railway disclosed on Oct. 21 that an attacker may have accessed and read contents of encrypted customer environment variables, which could include API keys, database credentials, and private registry credentials. The company urged all users to replace stored credentials immediately. Separately, on-chain investigator @tayvano_ alleged roughly $371,000 in stolen crypto across at least 19 EVM chains, identifying an attacker address, though Railway has not confirmed this theft claim. Railway invalidated its API tokens on Oct. 22 and restored builds for Pro and Enterprise tiers.