On 30 March 2026, Railway published an engineering post-mortem: a deployment accidentally turned on CDN caching for a small share of projects that had left CDN disabled, so GET responses—potentially including authenticated page content—could be cached and served to the wrong user during a short UTC window. The company reverted the change, purged caches, and described customer notifications where applicable.
This is an infrastructure confidentiality failure distinct from ransomware or a single stolen SQL dump; impact depends on each app’s caching headers and content.
Canonical record: Railway 2026 on BreachHistory.
Sources: Railway engineering blog, status incident