Railway urges credential resets as investigator alleges $371,000 crypto theft

Railway, a cloud deployment platform, has urged every user to replace stored secrets after disclosing on Oct. 21 that an attacker may have accessed encrypted customer environment variables and read some of their contents. Railway said those variables may contain API keys, database credentials and private registry credentials. Although its initial analysis suggested the impact might be limited to a subset of users, its security disclosure urged all customers to replace stored variables and credentials immediately and review service logs for unusual activity.