An update on the Railway security incident

Hi, Rayyan Ansari here. For the sake of transparency with our customers, I wanted to provide some clarity on a few things.

What happened

For those who don’t know, we use Railway for our deployments. Unfortunately, on Wednesday, October 21, I received information, first from a contact who works with Railway and later as confirmation from Railway themselves via an email alert, that our API keys may have been leaked.

I then received an email on October 23 saying that our API keys did in fact match a pattern the attacker was using to search for API keys.

It’s unclear if the Railway attack is connected to PHP2Shell, the critical PHP vulnerabilities disclosed the same week. Railway hasn’t published a root cause yet.

It’s also worth noting that around this time, Railway paused new deployments. This has since been reportedly resolved.

What this means for you

Rest assured, we rotated our API keys promptly when we got news of the potential credential leak.

We found no evidence that the API keys for our AI providers were used. More importantly for you, we found no evidence of any unauthorized access to our cloud infrastructure.

There is no credible evidence that any PII (personally identifiable information), sensitive company information, or any other sensitive data was accessed.

As the person ultimately responsible for all technology at Cognitivv Corporation, I am committed to both transparency and the security of our platforms, and I take that responsibility seriously.

Thanks,

Rayyan