Railway hit by security breach: customer secrets may be exposed, rotate your keys now
Cloud platform Railway says an attacker may have accessed customer environment variables, including some decrypted values. Deployments are paused and every user is being told to rotate API keys and passwords.
Railway, the popular cloud platform that developers use to deploy apps, databases and AI tools with a few clicks, has disclosed a security incident. The company says an attacker may have accessed customer environment variables, the place where apps usually keep their most sensitive secrets.
The disclosure came on October 21, 2026. Railway has paused deployments while it investigates and is asking all customers to change (rotate) their secrets right away.
What happened?
Railway says it detected unusual activity in the systems that store customer environment variables. According to the company, an unauthorized third party may have accessed these variables, “including some decrypted values”.
Environment variables often hold things like:
- API keys for services such as OpenAI, Stripe or AWS
- Database passwords and connection strings
- Private registry credentials used to pull code and container images
If an attacker has these values, they may be able to use your paid services, read your database or reach other systems connected to your app.
Railway says initial findings suggest only a subset of users were affected, and it will email customers directly once their accounts are confirmed as affected. The company has not said how many accounts are involved, who the attacker is, or exactly how the attacker got in.
Why would attackers target Railway?
Railway believes the incident is part of “a series of attacks recently targeting platform companies with the aim of compromising AI inference providers”, according to reports from GitGuardian and Cybersecurity News.
In simple terms: AI services are expensive to run, and stolen API keys can be sold or abused to run AI models for free on someone else’s bill. Hosting platforms are attractive targets because one breach can expose keys from thousands of apps at once. Railway says it has contacted the affected upstream providers and asked them to revoke keys proactively, but did not name them.
GitGuardian notes this follows a similar incident at Vercel earlier this year, which suggests a wider pattern of attacks on developer platforms.
Deployments paused
As a safety step, Railway has paused new deployments and builds. Its status page showed builds as unavailable from early on October 22 (02:19 UTC). Apps that are already running should keep working, but you cannot push new code until builds are restored.
Railway is also rotating all storage bucket credentials as a precaution. The new credentials appear automatically in customer dashboards, but apps need a redeploy to pick them up, which is not possible until builds resume.
When a platform that stores your secrets is breached, the safest assumption is that your secrets are no longer secret.
What should Railway users do now?
Don’t wait for an email. Security experts advise treating every secret stored on Railway as exposed until proven otherwise.
- Make a list of your secrets. Go through each service and note every API key, password and token in its variables. GitGuardian suggests exporting them with the Railway CLI so nothing is missed, then deleting that file when you’re done.
- Rotate at the source first. Create new keys in the original service (AWS, Google Cloud, GitHub, OpenAI, Stripe, your database and so on) and revoke the old ones. Changing the value only in Railway is not enough, because the old key would still work.
- Update the values in Railway, then redeploy once builds are back.
- Check your logs and bills. Look for unusual API usage, strange logins, new users or unexpected spending, especially on AI services. Railway has published guides for checking AWS, Google Cloud and GitHub activity.
- Watch Railway’s status page to know when deployments are restored.
Lessons for every developer
This incident is a reminder that where you store secrets matters, whatever platform you use:
- Give each API key the smallest permissions it needs.
- Set spending limits and alerts on paid APIs, so a stolen key can’t run up a huge bill.
- Rotate keys regularly, not only after a breach.
- Where possible, use short-lived credentials instead of long-lived keys.
What we don’t know yet
The investigation is still going on. Key questions remain open: how the attacker got in, how many customers are affected, how decrypted values were obtained, and whether Railway’s “sealed” variables (which cannot be read back through the dashboard) were exposed. We will update this article as Railway shares more details.
