Railway Breach: Env Secrets Exposed, All Deployments Halted
Railway found intruders may have decrypted customer env secrets on Oct 21. All deployments are paused, and every user must rotate API keys and passwords now.
Cloud hosting platform Railway has disclosed a security incident that may have exposed some of its customers' most sensitive data. The company detected intruders in the systems that store customer environment variables, paused all deployments, and told every user to rotate their secrets as if they had been leaked.
What happened
Railway published a security disclosure on Wednesday, October 21, 2026, written by Jacob Cooper. The company said it detected anomalous activity that morning in the systems that store customer environment variables - the settings where apps keep the secrets they need to run. According to the disclosure, an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Those variables typically hold API keys, database credentials and private registry credentials. Railway believes the incident is connected to a series of attacks recently targeting platform companies with the goal of compromising AI inference providers. Security analysts note the pattern echoes an incident at Vercel in April.
Deployments frozen, tokens invalidated
Railway took drastic containment steps. It paused all deployments across every region, including Enterprise customers, meaning no user could ship new versions of their apps until builds were reinstated. The company also invalidated all OAuth sessions, forcing users to sign in again, and invalidated all Public API tokens. Railway started rotating all storage bucket credentials on its side, and its staff posted thirteen rotation guides covering database credentials, cloud keys, GitHub, Stripe and AI provider checks. Railway's first assessment says only a subset of users may be affected, and it will email those customers directly. But its advice to everyone is the same: act as if your secrets are exposed.
Why this one hits hard
Railway is a widely used platform: in January the company said 2 million builders and tens of thousands of companies use it, from small shops to Fortune 500s. Environment variables are the crown jewels of a hosting platform, since one leaked key can unlock an AI provider account, a database or a code repository. The incident also fits a worrying trend. Stolen AI API keys have a real black market value, with each key yielding hundreds or thousands of dollars of inference before revocation. That makes every platform holding customer secrets a target.
What you should do
If you run anything on Railway, do not wait for the email. Rotate every environment variable, starting at the service that issued the key - that means creating a new key at your AI provider, database or registry first, then updating Railway. Invalidated API tokens need to be replaced, and OAuth sessions must be re-authenticated. Also review your service logs for unusual activity. By October 22, Railway had started bringing builds back in stages, with Enterprise workspaces first, followed by Pro, Hobby, Free and Trial plans. The investigation is still ongoing.
Sources
- GitGuardian - https://blog.gitguardian.com/railway-october-2026-incident-environment-variables/ - Cryptopolitan - https://www.cryptopolitan.com/railway-halts-deployments-api-keys-theft/ - Threat Atlas India - https://threatatlasindia.com/stories/railway-security-disclosure/ - PANews - https://www.panews.io/articles/01a16094-7ee8-7402-939e-4b8364d8eb47