Railway, a cloud platform many companies use to host websites, APIs and apps, disclosed on October 21, 2026 that an unauthorized party may have accessed customers' environment variables and, in some cases, read their decrypted contents. Those variables often hold API keys and database passwords. Railway is asking every user to rotate them.
What we know
- What happened: according to Railway's security notice, the company detected anomalous activity on October 21 in the systems that store customer environment variables. Its investigation so far indicates that an unauthorized third party may have accessed encrypted variables and, for some of them, obtained the decrypted contents.
- Who is affected: Railway says its initial analysis suggests the impact "may be limited" to a subset of users, but it recommends that everyone act. It will email the accounts it confirms as affected.
- What it asks users to do: immediately rotate all environment variables stored in Railway, including API keys and private registry credentials, and review the logs of those services for unusual activity.
- The likely target: Railway believes the attack is part of a series aimed at platform companies in order to reach AI inference providers. It says it notified those providers so they can proactively revoke keys.
- Deployments are paused: according to the notice and the status page, all builds and deployments are stopped during the investigation. Railway acknowledges that until they return, customers cannot roll out new credentials to their apps.
- What Railway has already done: its status page says it is rotating all storage bucket credentials (new ones appear automatically in the dashboard) and invalidated sign-in sessions, so some users will have to log in again.
- Timeline: the incident first appeared on the status page on October 21 at 07:24 UTC as a service problem; the security notice was linked at 21:59 UTC. At 01:22 UTC on October 22, Railway published thirteen guides with recommended steps: check for unexpected usage in OpenAI, Anthropic, Grok, OpenRouter and Stripe, look for anomalous access in GitHub, AWS and Google Cloud, and rotate PostgreSQL, MySQL, MongoDB and Redis credentials. It notes that some steps need a redeploy and will have to wait, but others can start now. As of 03:00 UTC, builds were still paused.
What changes and what doesn't
Nothing changes if you have no services on Railway. There is also no official figure yet on how many accounts were affected or which specific variables were read.
It does change things for any business whose site or app runs on Railway: every key stored there should be treated as exposed, even if the account never gets the email. And there is a practical catch: with deployments paused, a new key cannot go live until Railway re-enables builds. Revoking the old key first may take the service offline for a while.
How to tell if you're affected and what to do today
- Find out whether your site or app runs on Railway. If a developer or agency built it, ask them directly. In the Railway dashboard, each service lists its variables under the Variables tab.
- List what those variables contain. Typical entries: payment gateway keys, AI provider keys, transactional email, cloud storage, database passwords, and GitHub or container registry tokens.
- Set an order. A sensible way to prioritize while redeploys are blocked: first anything that costs money or opens data (payments, AI, cloud, database, private registries), even if the service goes down for a while; lower-risk keys once deployments are back.
- Revoke at the provider, not just in Railway. Changing the variable's value does not kill the old key: delete it in each service's dashboard (Stripe, OpenAI, your cloud) and create a new one. Railway notified AI providers, but that does not replace your own revocation.
- Set spending limits and review usage since October 21 in your AI and cloud dashboards. Off-hours spikes or models you don't use are the classic sign of someone else using your keys.
- Start today with what doesn't need a redeploy. Railway's guides on unexpected usage at AI providers and Stripe, and on anomalous access in GitHub and the cloud, can be followed now. For the rest, watch the status page and deploy with the new keys once builds return.
Related: LiteLLM 1.107.0 Shipped Malware: What to Do With AI Keys
Sources
- Railway, "Security Disclosure: Wednesday October 21st"
- Railway status page ("Railway Platform Outage" incident)
Updates: if Railway publishes how many accounts were affected or restores deployments, it will be added here with a link.