Cloud development platform Railway has warned all customers to rotate every secret stored on the platform after detecting suspicious activity in the systems that hold customer environment variables. In a security disclosure published October 21, 2026, the company said an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.
Environment variables on Railway commonly hold secrets such as API keys, database credentials and private registry credentials. OpenClassActions notes that these can include keys to paid AI services. Railway said its initial analysis suggests the impact may be limited to a subset of users, but it instructed all customers to act as if every variable is exposed.
Railway said it believes the incident is part of a series of recent attacks targeting platform companies with the aim of compromising AI inference providers. Security Boulevard compared the pattern to a Vercel incident from April.
What Railway has done
Railway paused all deployments while it investigates, meaning customers could not roll out new versions until builds were restored. Its status page says all Railway API tokens have been invalidated, and the company said it has rotated internal storage bucket credentials and notified upstream providers so they can proactively revoke potentially exposed keys. Railway has committed to emailing customers it confirms were affected and to publishing a formal postmortem once service is fully restored, according to a company employee posting on Hacker News.
Deployments are coming back in stages. A Dev.to write-up and TokenPost report that Enterprise builds resumed at 03:32 UTC on October 22, with Pro, Hobby, Free and Trial plans still awaiting restoration in that update. Pwn.watch lists no CVEs associated with the incident and describes it as ongoing as of October 22.
What customers should do now
- Rotate every environment variable stored in Railway, including API keys, database passwords and private registry credentials.
- Review logs from connected services — cloud providers, databases, AI inference providers — for unusual activity.
- Redeploy applications with fresh secrets once your project’s deployment capability is restored.
- Expect Railway API tokens to have been invalidated and to require regeneration.
TokenPost reports that Railway advised all users to rotate every key and password on the platform even though the exposure may involve only some customers.
What is still unclear
Railway has not said how the attacker gained access, how many accounts were affected, or which other platform companies it was referring to. Mallory.ai adds that the company has not identified the attacker or confirmed any downstream misuse of exposed credentials, and that identification of affected accounts is ongoing.
HokaNews reported suspected crypto wallet drains totaling roughly $369,300 in the same timeframe but explicitly said no direct connection to the Railway incident has been officially confirmed. OpenClassActions reports that, as of October 22, no lawsuits or settlements have been filed related to the incident.