2026 Railway — anomalous access to systems storing encrypted environment variables; subset of users affected
Data compromised
Encrypted environment variables for a subset of users, with decrypted contents obtained for some. Railway says these may include API keys, database credentials and private registry credentials.
Technical writeup
Verified Railway security disclosure (Oct 21, 2026). Railway detected the activity the morning of Oct 21, paused deployments and builds, notified upstream providers to revoke keys proactively, and advised customers to roll all environment variables, including API keys and private registry credentials, and to review logs. Railway says an unauthorised third party "may have accessed encrypted environment variables" and, for some, decrypted contents; impact "may be limited to a subset of users" and affected customers will be emailed. Per The Hacker News, Railway rotated its bucket credentials and invalidated Railway API tokens, and restored builds for Pro and Enterprise workspaces on Oct 22 (Hobby, Free and Trial still pending). A researcher reported crypto-wallet drains linked to private keys stored on Railway; not confirmed by Railway. Railway attributes the activity to a wider campaign against platform companies (its belief, not a finding). recordsAffected 0 (no count given).
Root cause
Not disclosed. Railway detected "anomalous activity involving systems that store customer environment variables" on Oct 21 and is still investigating how access was obtained.