Railway Cloud Platform Security Incident (October 2026)

Railway says that on 21 October 2026 it disclosed anomalous activity involving systems that store customer environment variables. Its preliminary report of 22 October says it became aware of the attack on 20 October at 19:53 UTC. Its investigation to date indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents.

Railway says environment variables may contain secrets such as API keys, and database and registry credentials. It believes the impact may be limited to a subset of users, but it recommends that all users act as a precaution.

Railway paused all deployments while it investigated. On 22 October its status page showed builds returning in stages. Railway published a preliminary report the same day and says a final forensic report will follow. Wiz counts Railway among at least nine AI developer platforms with incidents in October 2026; Northflank is another, covered in our report on the Northflank incident.

For the order in which to change your secrets, see our Railway breach rotation checklist.

Railway’s notice of 21 October says only that the activity involved systems that store customer environment variables. It adds that the third party may have obtained the decrypted contents of some of them. Its preliminary report of 22 October adds that it first saw an attempted privilege escalation in its build infrastructure on 20 October. Further routes of access were identified on 21 October.

It says the attacker pulled encrypted secrets, then reached CI credentials and decrypted artifacts that held more API access. A database query of encrypted environment variables followed, and a subset was decrypted using the compromised credentials. Railway says it cannot yet share the specific details of the exploits.

Railway says it believes the incident is part of a series of attacks on platform companies, aimed at compromising AI inference providers. It notified those upstream providers so they could revoke keys early.

No attacker is named. Railway states a belief that this is part of a series of attacks on platform companies, aimed at AI inference providers, but it does not name an actor. Its 22 October preliminary report also names none. It describes an external hostile party that Railway believes had access to "abliterated models and substantial compute resources" and was likely looking for AI and platform API keys.

Railway says the impact may be limited to a subset of users and that it will email customers it confirms as affected. Its preliminary report says at most 1.85% of all workspaces, about 100,000, had some environment variables potentially compromised. Vendors received reset requests for up to all stored keys, so more users than that heard from vendors.

Railway also says it is contacting customers it rates as high risk, a group larger than that 1.85%. It dates the attack window from 20 October 13:58 UTC to 22 October 03:32 UTC and has not published the number of variables decrypted. Customers lost the use of deployments while builds were paused.

Railway’s own response, as of 28 October 2026:

• Railway paused all deployments on 21 October and re-enabled builds in stages from 22 October (status page).
• It rotated every storage bucket credential and reset the GitHub tokens it held for customer accounts (Railway guide, 22 October).
• It invalidated all API tokens and Project Tokens created before the incident (status page).
• It published step-by-step guides for PostgreSQL, MongoDB, Redis and MySQL credentials, and for AWS, Google Cloud, GitHub, Stripe, OpenAI, Anthropic, Grok and OpenRouter.
• It rolled all keys, then rolled them again after confirming the intruder was out, and rebuilt its infrastructure tooling from validated source (preliminary report, 22 October).
• It moved builders from multi-tenant infrastructure to single-tenant environments ahead of plan, and added a way to revoke Railway application permissions in bulk (preliminary report).
• It engaged an external forensics firm. On 26 October it said services were fully restored for existing users, with new signups still paused (report addendum; status page, 27 October).