Railway paused deployments after finding unusual activity in systems holding customer environment variables, saying an unauthorized party may have accessed encrypted values and recovered readable contents from some.
The settings can contain API keys, database login details and private registry credentials. Railway said its initial review pointed to a limited subset of users, but urged every customer to rotate stored variables and inspect service logs for unusual activity.
In a 1 p.m. ET (17:00 UTC) update on Oct. 22, Railway said Pro and Enterprise deployments had regained normal speed, although some builds failed soon after starting. Hobby, Free and Trial builds remained under restoration.
Railway said it detected the activity on Oct. 21. The company has not identified the third party or disclosed how many accounts may be affected. It said it would notify customers as it confirms which accounts were affected.
