Railway infrastructure compromise assessment: 22 protocols report no exposure, 3 have limited/mitigated exposure with key rotation, and Swell (rswETH) remains under ongoing exploit.
Security & Exploits ·
Railway's infrastructure has been compromised, according to a security notice, with attackers actively extracting API keys from the platform. Users have been advised to rotate all API credentials immediately, and deployment services are currently offline, making swift key rotation a priority rather than waiting for systems to come back online.
The ongoing attack involves real-time key exfiltration, though the initial assessment indicates minimal financial loss to the platform itself. The incident remains active as of the notice, with no timeline provided for full infrastructure recovery or confirmation of how many user accounts or keys may have been exposed.
It remains unclear what attack vector enabled initial access, whether Railway has identified and remediated the root vulnerability, or what scope of user data beyond API keys may have been compromised. Users relying on Railway for deployments face operational disruption until services stabilize.