Security Disclosure

What happened

Railway found strange activity on the systems that store customer environment variables. These are settings that programs use to run, and some hold secret passwords or keys. An unauthorized outside party may have read encrypted settings. For some of them, the party may have seen the unlocked contents.

Key facts

• The company found the activity early on Oct 21, 2026.
• Environment variables may hold secrets such as API keys, database passwords, and private registry credentials.
• Early checks suggest only a subset of users may be affected.
• All deployments are paused until builds are restored.

Why this was a big attack

Railway believes this is part of a wider series of attacks on platform companies. The attackers seem to aim at companies that run AI inference providers, which are services that run AI models. Railway has told these upstream providers to cancel all keys as a safety step.

Why it matters

If a secret key is stolen, someone else can use it to log in to your services, read your data, or run up your costs. Even if your account was not in the affected group, the company says everyone should act now, because it is not yet clear who was hit.

What to do and what to watch

• Change all environment variables and API keys stored in Railway now.
• Change any private registry credentials.
• Check logs for those services for unusual activity.
• Watch the incident page to learn when builds come back.
• Look for an email from Railway if your account was affected.