Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables.

Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users," although it did not disclose an exact number.

Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags. They are configured at the operating system or container environment level instead of hard-coding the values directly into a program's source code.

Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company also said it has notified upstream providers to proactively revoke the keys so as to prevent their abuse.

Customers are being urged to take the following actions as a precautionary measure -

According to security researcher Taylor Monahan (@tayvano_), the incident has also allowed the attackers (0xd9773325282874d18cb83f1fe50f14c39750b2ee) to drain cryptocurrency wallets whose private keys were stored on Railway. The first known cryptocurrency theft transaction is said to have occurred at 7:36 p.m., at least two hours before the incident was officially disclosed.

Railway has since rotated all Railway bucket credentials and invalidated Railway API tokens in response to the incident. It has also restored builds for Pro and Enterprise workspaces, allowing customers to apply new credentials added in Railway.

Source link