The Railway breach, disclosed on October 21, 2026, reached the systems that store customer environment variables, and Railway says an unauthorized party may have decrypted some of them. The deployment platform told every user to roll all environment variables, API keys and private registry credentials immediately, even though it believes only a subset of accounts was affected.
Railway Says an Intruder Reached Encrypted Environment Variables and Decrypted Some
Railway detected anomalous activity on the morning of October 21 in systems that store customer environment variables, according to a disclosure signed by Jacob Cooper. Its investigation so far indicates that an unauthorized third party may have accessed the encrypted variables and, for some of them, obtained the decrypted contents. Railway notes that these variables can hold API keys along with database and registry credentials, the secrets an application uses to reach everything else it depends on. Railway has not said how many customers were affected or what the root cause was. TechCrunch’s Zack Whittaker reported that founder and chief executive Jake Cooper said the company will publish a post-mortem.
Railway Links the Railway Breach to Attacks on AI Inference Providers
Railway believes the intrusion is one of a series of recent attacks on platform companies whose aim is to compromise AI inference providers. It says it notified those upstream providers and asked them to revoke all keys proactively. TechCrunch noted that the open-source coding tool OpenCode reported a similar theft of customer secrets earlier the same week, which we covered in our OpenCode breach report. Railway has not named the attacker.
Railway Paused Deployments and Is Restoring Builds One Plan at a Time
Railway paused all deployments while it investigated, so customers could not ship new versions during the window. By 20:29 UTC on October 22, its status page said builds and deployments for Pro and Enterprise workspaces were running normally. Hobby workspaces were next in line, with Free and Trial to follow, and new signups were temporarily paused. A separate fault caused some US West deployments to fail after their builds completed on October 22, which Railway reported fixed at 18:49 UTC.
Railway’s AWS Rotation Guide Starts by Deactivating Keys, Then Reading Logs
On October 22 Railway published step-by-step guides for checking AWS and Google Cloud accounts for misuse. The AWS guide, by Mykal Machon, tells users to create a replacement key and deactivate the exposed one before deleting it, using AWS’s allowance of two access keys per IAM user to avoid downtime. Users then update the key pair in Railway, where a shared variable edited once in project settings reaches every service that references it, and redeploy. The final step is to search CloudTrail event history for calls made with the old key, such as RunInstances, CreateUser or CreateAccessKey. That history is kept for 90 days and stored per Region, so the search has to be repeated in every Region.
Why This Matters for Engineering Leadership
Railway’s instruction is identical for every customer: replace every secret you stored with us. How long that takes depends on whether a team can say, for each variable, what it is, who issued it, which systems use it and how to swap it without an outage. A team that keeps that inventory can work through Railway’s guidance as a checklist. A team without one has to build the list first, while the exposed keys still work. Railway’s own AWS guide makes the cost of delay explicit: an exposed access key keeps working until someone deactivates it. Engineering leaders should treat this disclosure as a rotation drill whether or not they use Railway. Pick one platform that stores production secrets, time how long a full rotation takes, and record every key that had no owner or no documented way to replace it. Each of those is a credential that would outlive the next breach notice. The same week, attackers used a vendor’s stolen app credentials in the ConnectWise breach, a reminder that a secret held by a third party is only as safe as that third party.
FAQ
What happened in the Railway breach?
On October 21, 2026, Railway detected anomalous activity in systems that store customer environment variables. It says an unauthorized party may have accessed the encrypted variables and decrypted some of them.
Do all Railway users need to rotate their secrets?
Yes. Railway recommends every user roll all environment variables, API keys and private registry credentials stored on the platform, although its initial analysis suggests only a subset of users was affected.
Who was behind the Railway attack?
Railway has not named the attacker. It says the breach appears to be part of a series of attacks on platform companies aimed at compromising AI inference providers.
Can Railway users deploy again?
Railway paused all deployments during its investigation. As of 20:29 UTC on October 22, builds were running for Pro and Enterprise workspaces, with Hobby, Free and Trial still to follow and new signups paused.
How do I check whether an exposed AWS key was misused?
Railway’s guide says to deactivate the key, then search CloudTrail event history by that access key ID in every Region. Calls such as CreateUser or RunInstances that your app does not make point to misuse.
Will Railway publish a post-mortem?
Yes. Chief executive Jake Cooper told TechCrunch the company plans to publish one. Railway has not yet disclosed the root cause or the number of affected users.