When I last used Railway - the default behaviour for railway-hosted databases was for them to be inaccessible to the public internet - so a leaked DB connection URL might not be as catastrophic as you would first think...
The default setup is to configure an Internet accessible DB. So yes — the credentials leak has also likely compromised many databases too. They are still obscuring the impact.