Railway breach: all users told to rotate their secrets

Railway, a cloud platform where developers deploy their applications, disclosed on October 21, 2026 that an attacker may have reached its customers' secrets. The company says an unauthorized outside party may have accessed encrypted environment variables. For some of them, the attacker obtained the decrypted contents. Railway now asks every user to rotate every secret stored on the platform, whether or not the company has contacted them.

What Railway says happened

An environment variable is a named setting an app reads when it starts. Developers use them to keep API keys, database passwords and registry logins out of their source code. That makes the store of environment variables one of the most sensitive systems a hosting platform runs.

According to Railway's security disclosure, the company detected unusual activity in those systems "earlier this morning" on October 21. Its early analysis suggests a subset of users was affected. Railway has not said how many. It will email affected customers once it confirms which accounts were hit.

Railway has also not said how the attacker got in. TechCrunch reports that the company did not respond to a request for comment.

The company believes this is one of several recent attacks on platform companies "with the aim of compromising AI inference providers." Inference providers sell access to AI models, and customers pay for that access through API keys. Railway did not name the other platforms.

What Railway has done so far

Railway paused all deployments while it investigated. TechCrunch wrote that the pause effectively froze customer websites and apps. Railway also contacted its upstream providers and asked them to revoke keys as a precaution.

The Hacker News lists further steps. Railway rotated all of its storage bucket credentials and invalidated Railway API tokens. It then restored builds for Pro and Enterprise workspaces, so those customers can deploy the new credentials they create.

Other plans are still waiting. Railway's status page says it is "continuing to work on enabling builds for Hobby, then Free and Trial." It adds that some builds are still failing more often than usual and that many deployments remain queued.

A pattern of attacks on developer tools

Railway is not the first developer platform to lose customer keys this month. OpenCode said on October 17 that a breach hit 1.4% of its Console users, exposing the AI provider keys they had stored. TechCrunch notes that OpenCode called its incident an "AI distillation attack." Railway has not said whether the two are connected.

The Hacker News also cites security researcher Taylor Monahan. Monahan says attackers emptied cryptocurrency wallets whose private keys were stored on Railway. Railway's disclosure does not mention wallet theft.

What this means for developers

Treat every secret on Railway as exposed, even if you never get an email. The company's own advice applies to all users.

• Rotate at the source, not only in Railway. Editing a variable in the dashboard does not stop a stolen copy from working. Generate a new key at each provider, revoke the old one, then paste the new value into Railway.
• Start with the keys that cost money or touch data. That means AI provider keys, cloud keys and database passwords first. Railway also names private registry credentials.
• Read your logs. Railway asks users to review the logs of affected services for unusual activity. On October 22 it published two guides on checking for anomalous access in AWS and Google Cloud.
• Check your AI usage bills. Railway's own theory points at inference providers. A sudden jump in model usage is a quick sign that a key is in someone else's hands.
• Replace Railway API tokens in CI. Railway says it invalidated those tokens, so a deploy job that still uses an old one will fail until you create a new one.
• Move any crypto funds. If a wallet's private key ever sat in a Railway variable, rotating the variable does not protect it. Move the funds to a new wallet.
• Expect slow deploys for now. Follow Railway's status page, incident QH8L8B3E, to see when builds return for your plan.