Railway says an unauthorised party may have accessed customer environment variables

TLDR

• Railway says an unauthorised third party may have accessed encrypted environment variables and, for some, obtained decrypted contents.¹
• Railway reset all storage bucket S3 credentials and stored GitHub tokens, and urges all users to rotate every secret.¹⁵
• Builds were restored for Pro and Enterprise workspaces by 22 October, while Hobby, Free and Trial waited.³

Railway, a platform-as-a-service provider, said it detected anomalous activity on 21 October involving the systems that store customer environment variables.¹ Its investigation to date indicates an unauthorised third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents, which may include API keys and database or registry credentials.¹

Railway says it believes the incident is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively.¹ Its initial analysis suggests the impact may be limited to a subset of users, but it recommends all users roll their environment variables and private registry credentials and review logs for unusual activity.¹ The company said all deployments were paused while it investigated, so new versions could not be rolled out until builds were restored, and that it would email customers it confirms as affected.¹ LavX News, which rewrites Railway's disclosure, adds its own reading that compromised variables on such platforms could give attackers access to model APIs and inference endpoints across multiple customers.²

Railway has not published details on how the intrusion happened or how many users are affected, and the disclosure was still being updated.¹ LavX News rewrites Railway's disclosure, while BleepingComputer, TechCrunch and CryptoSlate add reporting, covered in the update below.²³⁴⁶

Why it matters: Customers should rotate every stored secret and redeploy services, because Railway also reset bucket credentials and GitHub tokens and has not yet disclosed the root cause or how many users are affected.¹⁴⁵

Update, 23 October 2026: Builds are coming back in stages, Railway has reset more credentials on customers' behalf, and an on-chain investigator alleges related crypto theft. BleepingComputer, citing Railway's status page, reports that as of 08:44 UTC on 22 October builds had been restored for Pro and Enterprise workspaces but deployments remained delayed with many queued, while Hobby, Free and Trial workspaces were still waiting and were to be restored in that order.³ It puts the platform at about 4.8 million users and more than 16 million hosted services.³ TechCrunch describes the pause on new builds and deployments as brief, with restoration beginning soon after, so accounts of how long customers were blocked differ.⁴

Railway has still not said how many users are affected or what the root cause was, and TechCrunch says it did not answer questions about whether hackers had contacted it, for example with a ransom demand.⁴ Railway chief executive Jake Cooper told TechCrunch the company plans to publish a post-mortem.⁴ TechCrunch also notes that OpenCode reported a similar breach of customer secrets earlier this week.⁴

Railway says it reset credentials on customers' behalf as part of the response: the S3 credentials for every storage bucket in every environment, and the GitHub tokens it held for customers' accounts and services.⁵ Services that read bucket credentials need a redeploy to pick up the new values, and customers must reconnect GitHub themselves because Railway cannot create new GitHub tokens for them.⁵ CryptoSlate reports that Railway also invalidated all Railway API tokens at 04:17 UTC on 22 October, so customers using them with its public API need replacements.⁶

CryptoSlate reports that on-chain investigator @tayvano_ alleged about $371,000 in cryptocurrency was stolen across at least 19 EVM chains using keys stored in Railway, and that Railway has not confirmed the claim, its connection to the incident or the figure.⁶