Article
Railway Breach: What to Rotate, in What Order, and What to Check
Railway says an unauthorized party may have read customer environment variables. Here is what to rotate, in what order, and which logs to check.
Read more
Significant cyber incident
Railway Cloud Platform Security Incident (October 2026)
Also known as Railway security disclosure, Railway environment variable exposure
On 21 October 2026 the cloud platform Railway said an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents.
In short
On 21 October 2026 the cloud platform Railway said an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents. Railway asked all users to roll every variable, API key and registry credential, paused deployments, and reset bucket credentials, GitHub tokens and API tokens itself. It has not yet published how many accounts were affected.
What happened
Railway says that on the morning of 21 October 2026 it detected anomalous activity involving systems that store customer environment variables. Its investigation to date indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents.
Railway says environment variables may contain secrets such as API keys, and database and registry credentials. It believes the impact may be limited to a subset of users, but it recommends that all users act as a precaution.
Railway paused all deployments while it investigated. On 22 October its status page showed builds returning in stages, and Railway said it would publish a full incident report on its blog once the incident is resolved.
For the order in which to change your secrets, see our Railway breach rotation checklist.
Timeline
- 21 Oct 2026, 07:24 UTC
Railway's status page opens a platform outage entry. Later entries say the dashboard, API and CLI are unavailable and builds are paused. Railway does not say in the pages we read whether this is linked to the anomalous activity.
- 21 Oct 2026, 20:19 UTC
Railway says it is invalidating OAuth sessions because of impact from adjacent cache systems. Affected users are signed out.
- 21 Oct 2026, 21:59 UTC
Railway publishes its security notice and recommends revoking all environment variables, API keys and private registry credentials stored in Railway.
- 21 Oct 2026, 22:10 UTC
Railway says it is rotating all bucket credentials. At 22:45 UTC it adds that customers will see the revocations by a Railway employee in audit logs.
- 22 Oct 2026, 01:22 UTC
Railway publishes security guides, among them PostgreSQL credential rotation and checks for unexpected usage of AI provider keys.
- 22 Oct 2026, 03:32 UTC
Builds for Enterprise workspaces become available again.
- 22 Oct 2026, 04:17 UTC
Railway invalidates all API tokens. Users must create new ones.
- 22 Oct 2026, 17:43 UTC
Railway says the API is fully restored. API tokens and Project Tokens created before the incident remain invalidated.
- 22 Oct 2026, 21:59 UTC
Builds are enabled for Hobby, Pro and Enterprise workspaces. Free and Trial workspaces are to follow, and new signups remain paused.
How the attack worked
Railway has not published how the third party gained access. Its notice says only that the activity involved systems that store customer environment variables, and that the third party may have obtained the decrypted contents of some of them.
Railway says it believes the incident is part of a series of attacks on platform companies, aimed at compromising AI inference providers. It notified those upstream providers so they could revoke keys early.
Who says who was behind it
No attacker is named. Railway states a belief that this is part of a series of attacks on platform companies, aimed at AI inference providers, but it does not name an actor.
No government agency or security company in the sources we opened has attributed the activity.
Impact
Railway says the impact may be limited to a subset of users and that it will email customers it confirms as affected. It has not published the number of accounts, the number of variables or the time window. Customers lost the use of deployments while builds were paused.
Government and regulator response
No government agency or regulator response had been published in the sources we opened by 23 October 2026. Railway’s own response:
- Railway paused all deployments on 21 October and re-enabled builds in stages from 22 October (status page).
- It rotated every storage bucket credential and reset the GitHub tokens it held for customer accounts (Railway guide, 22 October).
- It invalidated all API tokens and Project Tokens created before the incident (status page).
- It published step-by-step guides for PostgreSQL, MongoDB, Redis and MySQL credentials, and for AWS, Google Cloud, GitHub, Stripe, OpenAI, Anthropic, Grok and OpenRouter.
Lessons
-
A platform that holds your secrets is a supplier
Railway stored environment variables for its customers, so one incident put every customer's keys in question. Track such platforms as third-party risk.
-
Rotation is only done after a redeploy
Railway's guides say containers read variables only at startup. A service keeps using the old secret until it restarts.
-
Rotate and then look back
A new password stops future access but does not show whether the old one was used. Railway's guides pair each rotation with a log review at the provider.
-
Use references instead of pasted values
Railway tells users to replace pasted connection strings with reference variables, so the next rotation reaches every service automatically.
What to check in your own organization
-
List every secret stored in Railway
Open each service's Variables tab and the shared variables in Project Settings. Note pasted connection strings and copies outside Railway, such as CI jobs and BI tools using the public database URL.
-
Rotate databases with Regenerate
In the Database tab, use Regenerate rather than editing the password variable or running ALTER USER. Redeploy every service that references it.
-
Rotate cloud, payment and AI keys at the provider
Deactivate the old AWS key, disable the old Google Cloud key with the gcloud CLI, rotate the Stripe key, and delete and recreate AI provider keys.
-
Review provider logs for the exposure window
AWS CloudTrail event history by key ID in every Region, Google Cloud audit logs by service account, the GitHub security log (90 days) and organization audit log (180 days), and Stripe request logs for the old key.
-
Check sessions on the database
After a PostgreSQL rotation, list pg_stat_activity. A session you do not recognize connected with the new password.
-
Create new Railway tokens and reconnect GitHub
All earlier API tokens are invalid. Reconnect GitHub in Account Settings and replace any ghcr.io token with a new one that has the read:packages scope.
Questions
What did Railway say was accessed?
Railway says an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.
Who is behind the Railway incident?
No one has been named. Railway believes it is part of a series of attacks on platform companies aimed at AI inference providers.
Do all Railway users need to rotate secrets?
Railway recommends it for all users as a precaution, and says it will email customers it confirms as affected.
Is Railway working again?
At 21:59 UTC on 22 October Railway's status page said builds were enabled for Hobby, Pro and Enterprise workspaces. Free and Trial were still to follow.
Has Railway published a full incident report?
Not in the pages we read. Railway says it will publish one on its blog once the incident is resolved.
In our research
Sources
- Security Disclosure: Wednesday October 21st Railway Blog
- Railway Platform Outage Railway Status
- Redeploy Buckets and Reconnect GitHub After the Credential Reset Railway Blog
- Rotate PostgreSQL Database Credentials Railway Blog
- Check for Anomalous AWS Access Railway Blog
- Check for Anomalous GCP Access Railway Blog
- Check for Anomalous GitHub Access Railway Blog
- Check for Unexpected Usage in Stripe Railway Blog
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 64 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 108 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.