What changed
On October 21, 2026, Railway reported anomalous access to systems storing customer environment variables. Its initial investigation indicates an unauthorised third party may have accessed encrypted variables and, for some, decrypted contents. Initial analysis suggests a subset of users, but Railway urged all customers to rotate stored secrets and registry credentials and review logs. It paused builds. On October 22, Enterprise builds returned first, Pro builds at 06:29 UTC; the 07:11 UTC status still reported queues and Hobby, Free and Trial access awaiting restoration. Railway invalidated all Public API tokens and rotated storage-bucket credentials.
Why it matters
Railway applications often store database passwords, AI-provider tokens, payment credentials, registry secrets and cloud keys. Possible plaintext exposure can permit downstream access without application code compromise. Rotation can require redeployment, yet builds were paused and remain tier-dependent. Small teams should prioritise revocation, log inspection and validated recovery without assuming absence of an individual breach notice proves safety.
Confirmed incident and unresolved scope
Railway says an unauthorised third party may have accessed encrypted environment variables and decrypted some contents. No verified victim count, exploit method or exfiltration volume is public. Its suggestion of a campaign targeting AI inference providers is preliminary; its precautionary rotation advice applies to every customer.
Secrets and downstream accounts
Rotate keys and passwords at their issuers, including AI providers, databases, payment services, private registries, GitHub and cloud services; review logs and unexpected spend. Update Railway configuration and verify new values are used by running services. Editing a variable without successful redeployment may leave an application using old credentials.
Build and deployment recovery
Railway initially paused deployments. Enterprise builds returned first and Pro builds by October 22 06:29 UTC. At 07:11 UTC, deployments were still queued or slow, while Hobby, Free and Trial build access awaited restoration. These are time-specific observations, not current-availability guarantees.
Railway credentials and remediation guides
Railway invalidated all Public API tokens at 04:17 UTC on October 22, requiring integrations to create replacements. Railway also rotated bucket credentials and temporarily invalidated OAuth sessions. Its status page links specific guidance for PostgreSQL, MySQL, Redis, MongoDB, buckets, GitHub, OpenAI, Anthropic, OpenRouter, Grok, Stripe, AWS and GCP.
Operational sequence
Inventory stored Railway secrets, revoke and rotate the highest-impact provider credentials, inspect audit and usage logs, update Railway variables, redeploy when your tier allows it and validate the running service. Confirm which Railway-managed credentials were rotated automatically and which third-party credentials require action. Do not post sensitive logs or keys publicly.
Evidence and caveats
The disclosure and status timeline are primary records. Independent reporting corroborates Railway's announcement but does not independently prove how many secrets were decrypted or abused. Neither widespread exploitation nor a confirmed victim count should be inferred.