Overview
Cloud deployment platform Railway disclosed a security incident on October 21, 2026 and told all users to rotate their secrets. The company detected suspicious activity on systems that store customer environment variables, and says an unauthorized third party may have accessed them and, for some, obtained the decrypted contents.
Environment variables on Railway commonly hold API keys, database credentials and private registry credentials.
What Railway Has Said
| Item | Detail |
|---|---|
| Disclosure | October 21, 2026 |
| Data at risk | Encrypted environment variables, with decrypted contents obtained for some |
| Scope | Initial analysis points to a limited subset of users; investigation ongoing |
| Attacker / method | Not identified or disclosed |
| Downstream misuse | Not confirmed by Railway |
Railway says the incident is part of a series of attacks targeting AI inference providers. Those providers were notified and advised to revoke all their keys. Security researcher Taylor Monahan separately reported that attackers drained cryptocurrency wallets whose private keys were stored on Railway.
Railway's Response
- Builds and deployments were suspended platform-wide. That pause initially stopped customers from deploying updates that carry replacement credentials.
- All Railway bucket credentials were rotated and Railway API tokens were invalidated.
- Builds were restored for Pro and Enterprise workspaces so customers can apply new credentials.
Recommended Actions
- Rotate every secret stored in Railway: API keys, database passwords, private registry credentials, signing keys and wallet keys
- Prioritize AI provider keys (inference and model APIs), which appear to be the attackers' focus
- Review service logs for unusual access or usage spikes
- Check copies of revoked credentials in CI/CD systems, local developer environments and other cloud services, and rotate those too
- Re-issue Railway API tokens because existing ones were invalidated
- Treat crypto wallet keys as compromised if they were stored as variables and move funds to new wallets
Why It Matters
Platform-level secret stores concentrate credentials from many customers in one place. A compromise there bypasses each customer's own perimeter, and the stolen keys can be used from anywhere. The incident follows a pattern of attacks on developer platforms where environment variables were the prize. Where possible, use short-lived credentials, scoped tokens and provider-side spend limits so that a leaked key has a limited blast radius.