Railway Says Unauthorized Party May Have Accessed Encrypted Environment Variables

Incident Overview

On October 21 2026 Railway disclosed that it detected anomalous activity in systems that store customer environment variables. An investigation found that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.

Environment variables can hold secrets such as API keys, database credentials, and registry credentials. Railway believes the breach is part of a series of attacks aimed at platform companies that provide AI inference services.

Recommended Actions

The company recommends that all users immediately rotate every environment variable stored in Railway, including API keys and private registry credentials. Users should also review logs for those services for any unusual activity.

All deployments have been paused while the investigation continues. Until builds are restored users cannot roll out new versions. Railway apologized for the inconvenience and asked users to follow the incident page for notifications when builds resume.

Ongoing Investigation and Updates

Railway has notified upstream providers to revoke all keys proactively. As the scope of impact is narrowed, the company will contact affected customers directly by email with additional details.

Updates will be posted on the announcement page and on status.railway.com. On October 22 2026 Railway published engineering guides on checking for anomalous GCP access and anomalous AWS access.

Sources: Railway Blog