**Railway**, a prominent cloud platform for developers, has disclosed a security incident that could impact millions of users. The company, which hosts over 16 million services for approximately 4.8 million users, identified unauthorized access to systems storing customer environment variables. ### Decrypted Secrets at Risk According to **Railway**'s statement, their investigation indicates that an unauthorized third party may have accessed encrypted environment variables. Crucially, for some of these, the decrypted contents were also obtained. Environment variables are critical, often containing sensitive information such as API keys, database credentials, and private registry credentials. ### Broader Attack Campaign Suspected **Railway** believes this incident is part of a larger series of attacks targeting **AI inference providers**. These providers, which run AI models for **Railway**-hosted applications, were directly notified and advised to revoke all their keys as a precautionary measure. ### Immediate Action Required for Users While initial analysis suggests only a subset of users may be directly affected, **Railway** is strongly urging *all* users to immediately rotate environment variables and secrets stored on the platform. This includes private registry credentials. Users are also advised to review associated service logs for any unusual or suspicious activity. ### Operational Impact and Recovery In response to the breach, **Railway** temporarily paused all deployments to contain the incident and facilitate the investigation. As of October 22, builds for Pro and Enterprise workspaces have been restored, though deployments continue to experience delays. Builds for Hobby, Free, and Trial workspaces are expected to resume sequentially. **Railway** has committed to directly notifying users whose accounts are confirmed to be compromised, providing further specific details as the investigation progresses.