What Railway's security incident means for Ghostifier
Railway, the company that hosts Ghostifier, was broken into on October 20 to 22. Here is what happened and what we did to protect you.
On October 21, Railway, the company that hosts Ghostifier, told its customers that someone had broken into its internal systems. We use Railway. This post says what happened, what we did to protect you and what you can do. We will keep it up to date.
The short version
- Someone broke into Railway's systems between October 20 and October 22 and read, and in some cases decrypted, secrets that customers store with Railway.
- Railway has not told us that any of Ghostifier's secrets were affected. It cannot yet say whose were, so we acted as though ours might be.
- We replaced every credential we keep with Railway, as a precaution.
- We checked all of our logs and found no suspicious activity.
- You do not have to do anything. There are a few optional precautions at the end.
What happened at Railway
Everything in this section comes from Railway's own reports, which we link below so you can read them yourself.
Railway says its monitoring flagged unusual activity on October 20, and that it spent the next two days containing it. Its investigation so far says the attacker was inside its internal systems from about 14:00 UTC on October 20 until 03:32 UTC on October 22, when Railway confirmed the attacker no longer had access. The attacker was looking for keys to AI services. Along the way it read the secrets that customers store with Railway, such as API keys and database passwords, and decrypted some of them.
Railway cannot tell which customers' secrets were decrypted. It says at most about 1.85% of all workspaces had secrets potentially affected, and that it contacted customers it believes were at higher risk. Railway also says:
- No customer's Railway account was logged into, and running apps stayed online.
- It has not ruled out access to source code, and will settle that in its final report.
- It brought in outside forensic experts and the authorities.
- It paused builds and deployments for a time, rebuilt its build systems, and asked several outside providers to revoke keys it thought might be affected.
Railway's investigation is still open. As of the day we wrote this, its final report had not been published.
Railway's announcements and incident reports
If you want the primary sources, these are Railway's own pages. We will add Railway's final report here when it appears.
- Security disclosure, October 21: the first announcement.
- Preliminary report, October 22: the timeline, the scale of the impact, what Railway did, and its FAQ.
- Railway's status page and its incident history: the outage and the paused builds, with updates as they were posted. On October 24 Railway also published a clarification saying that later key revocations by AI providers were precautionary and not a new attack.
- Railway's guides for customers, published from October 22, on how to respond.
- Railway's contact for questions about the incident: support@railway.com.
What this means for Ghostifier
Railway hosts the Ghostifier app and the database behind your account, so we took Railway's announcement seriously from the start. Railway has not told us that any of our secrets were affected. Because it cannot say whose were, we treated ours as possibly exposed and acted on that.
What Ghostifier keeps is what our data page describes: your account, the list of companies found in your inbox, and the requests we sent for you. Some things never reach us. The contents of your emails stay with Google, because the permission you gave only lets us see who an email is from, when it was sent and its subject. Your card number goes straight to our payment processor.
What we did to protect you
We learned of Railway's disclosure on October 21 and acted at once.
- We replaced every credential we keep with Railway, as a precaution, across every service our app uses. We began on October 21 and finished the last of them on October 24.
- We checked all of our logs and found no suspicious activity.
- We signed everyone out, so that every login starts fresh.
- We are reviewing how we protect your information. A hosting incident is a prompt to look again at what could go wrong and to tighten it, and we are doing that. We will follow up here if anything changes what you can expect from us.
What we found, and what it does not tell us
We found no suspicious activity. That is a real result and we are glad of it. It is also a limited one: it means the logs we can read show nothing unusual. Railway's final report may tell us things we cannot see from our side. If it does, we will update this post and write to you.
What you can do
You do not have to do anything. If you want to take precautions:
- You may need to sign in again. Some links in older emails from us may no longer work.
- If you use the same password on Ghostifier and on another site, change it on the other site. It is a good habit whatever happens.
- If you want a clean start with Google, remove Ghostifier at myaccount.google.com/permissions and connect Gmail again from Settings. This is optional.
- Treat any email that claims to be from us and asks for a password, a code or a card number as fake. We never ask for those by email.
Timeline
Times are UTC. Railway's come from its preliminary report and status page.
| When | What |
|---|---|
| October 20, 13:58 | Railway's monitoring flags unusual activity (the start of the attack window Railway reports) |
| October 20, 17:03 | Railway declares an incident on its status page, "New builds are temporarily paused" |
| October 21 | Railway publishes its security disclosure and tells customers to replace their stored secrets |
| October 22, 03:32 | Railway confirms the attacker no longer has access to its internal systems |
| October 22 | Railway publishes its preliminary report and its first guides for customers |
| October 24 | Railway clarifies that later key revocations by AI providers are precautionary |
| October 21 | Ghostifier learns of the disclosure and begins replacing its credentials |
| October 24 | Ghostifier finishes replacing its credentials and checking its logs |
| October 24 | This post is published, and we write to everyone with an account |
Questions
Was my Gmail read? Ghostifier can only see the top part of each email: who it is from, when it was sent and the subject. It cannot open the body or attachments, and Google enforces that limit. We found no suspicious activity.
Was my payment information taken? Card numbers are never in our systems. They go straight to our payment processor, and we replaced our credentials with it.
Was my password taken? We do not keep your password in a form anyone could read back, and we found no suspicious activity.
Why are you telling me if you found nothing? Railway cannot say whose secrets were read, and you should hear from us, in our words, what happened and what we did.
Who do I write to? support@ghostifier.com. We will answer, and we will update this post when Railway publishes its final report or if we learn anything that changes what we have said here.