Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack

TechCrunch reports that Railway said in a blog post on Wednesday that the unidentified hackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents."[1]According to ME News, carried by KuCoin, Railway said these variables may have included API keys, database credentials, and image repository credentials.[2] TechCrunch reports that with these customer secrets, an attacker could also log in and access data as if they were the rightful owner.[1]TechCrunch says Railway's initial analysis suggests the breach was limited to a "subset of users,"[1] but the company still told "all users" to revoke and rotate their keys. TechCrunch adds that it's unclear how the attack went down or which Railway systems were compromised.[1]The Defiant reports that Railway put a deployment pause[3] in place that blocks application updates.[3] ME News reports that Railway has notified upstream service providers to proactively revoke the compromised keys.[2]According to TechCrunch, Railway said that the breach was likely part of a broader attack targeting platforms "with the aim of compromising AI inference providers."[1]TechCrunch also reports that earlier this week, open source AI coding tool OpenCode said customer secrets had been breached in a similar attack[1]. According to TechCrunch, hackers took more than 1% of OpenCode customers' API keys and other secrets, and OpenCode attributed the attack to an AI distillation attack[1].