Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
Development platform Railway has confirmed that a cyberattack allowed hackers to access some customer secrets, prompting the company to urge all users to rotate their API and cloud keys amid fears of a broader breach of customer data.
The company, which allows customers to build apps and services on its cloud development platform, said in a blog post on Wednesday that the unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.”
These environment variables are typically lists of passwords and API keys that are used by the developer’s apps to access other services, such as cloud data storage and databases. With these customer secrets, an attacker could also log in and access data as if they were the rightful owner.
Railway said that while its initial analysis suggests the breach was limited to a “subset of users,” it suggested that “all users”...
Copyright of this story solely belongs to techcrunch.com. To see the full text click HERE
