Cloud deployment platform Railway detected unusual activity in a system that stores customer environment variables, according to an official announcement. According to ChainCatcher, an initial investigation suggests an unauthorized third party may have accessed encrypted variables and obtained the decrypted contents of some, potentially including API keys, database credentials and container registry credentials. Railway believes the incident may be part of a recent series of attacks targeting platform companies to breach AI inference providers, and said it notified upstream service providers to revoke keys. Railway has paused all deployments and urged all users to immediately rotate environment variables, API keys and private repository credentials stored on the platform, and review relevant service logs.