Railway has detected anomalous activity on its systems, indicating that unauthorized third parties may have accessed encrypted environment variables and decrypted their contents. The company has suspended all deployments while investigating the incident.
The breach affects how applications store sensitive configuration data on the platform. Environment variables often contain API keys, database credentials, and other secrets critical to application security. If compromised, these credentials could be used to access downstream services and data.
Railway is notifying affected customers by email, but the company recommends that all users immediately rotate and replace any variables stored in the service, regardless of whether they received direct notification. You can track the ongoing investigation through Railway's status page. Until the investigation concludes and deployments resume, applications relying on Railway may experience disruptions.