Railway Says Intruder May Have Accessed Customer Secrets; Researcher Reports Crypto Wallet Theft
Summary
Railway says an intruder may have accessed some customers’ encrypted environment variables and, in some cases, decrypted contents. The company rotated bucket credentials and invalidated API tokens; a researcher also reported cryptocurrency theft.
Key points
- Railway disclosed anomalous activity involving systems that store customer environment variables and said a third party may have accessed encrypted values, including decrypted contents in some cases.
- Railway said the impact was limited to a subset of users but did not disclose how many were affected.
- Security researcher Taylor Monahan reported that attackers drained cryptocurrency wallets whose private keys were stored on Railway; the first known theft transaction reportedly occurred at least two hours before disclosure.
- Railway rotated its bucket credentials and invalidated API tokens, and urged customers to take precautionary steps, including rotating credentials.
- Railway restored builds for Pro and Enterprise workspaces; builds for Hobby, Free, and Trial workspaces were still being enabled, with delays and failures reported.
- The article also describes separate LLMjacking activity, including cloud credential theft and attackers abusing exposed AI systems to run cybercrime operations at victims’ expense.
Article Details
- Victim Organization
- Railway
- Incident Type
- Unauthorized access to customer environment variables, with possible access to decrypted secrets
- Data Types Exposed
- Customer environment variables, including potentially API keys and database credentials
- Affected Records
- An undisclosed subset of users; exact number not disclosed
- Operational Impact
- Railway rotated bucket credentials and invalidated API tokens. Builds were restored for Pro and Enterprise workspaces; builds for Hobby, Free, and Trial workspaces were still being enabled. Some builds were failing more often than usual, and deployments were queued with longer wait times.
- Claim Status
- alleged
People
Andre MaccaroneWiz researcher who reported on compromised Google Cloud Platform credentials and attacker-controlled projects linked to victim billing accounts.Shira AyalWiz researcher who reported on compromised Google Cloud Platform credentials and attacker-controlled projects linked to victim billing accounts.Taylor MonahanSecurity researcher who said attackers used exposed private keys stored on Railway to drain cryptocurrency wallets.
Vendors
GoogleIn one case documented by Wiz earlier this week, threat actors compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to the victim's internal billingRailwayPlatform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables.
Products
Gmailprivileges to deepen their access, circumvent security controls, and add external actor-controlled Gmail accounts directly into the organization's billing account.Google Cloud PlatformIn one case documented by Wiz earlier this week, threat actors compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to the victim's internal billingGoogle Sitesusers searching for common terms like "google cloud" or "gap" to a fake Google login web page via a Google Sites redirect, harvesting their account credentials and multi-factor authentication (MFA) codes in the