Railway said an intrusion could have exposed environment variables in up to 100,000 workspaces, or 1.85% of its total, setting a ceiling rather than a confirmed count.
The company’s Oct. 22 preliminary report said investigators could not identify which stored variable values the attacker recovered. Railway’s forensic review suggested the intruder was probably after AI service credentials and Railway platform API keys, with model-distillation attacks a likely objective.
As a precaution, Railway asked service providers to revoke keys. It sometimes sent them every key stored for a given provider, including keys investigators had not confirmed the attacker accessed.
Existing deployments stayed online while Railway paused new builds and deployments. In an Oct. 23 status update, Railway reported normal operation for its build and deployment services, API and dashboard; new signups remained paused. The disclosure follows Railway’s earlier warning about possible secret exposure.
Security researcher Taylor Monahan put the crypto losses she associated with the incident at about $371,000. Railway has not tied the transfers to its platform; nor has it confirmed that wallet credentials were exposed or accepted Monahan’s estimate.
Railway said its investigation was continuing in the Oct. 23 update.
