Summary
Railway says an investigation found possible access to customer environment variables, including the possibility that some contents were decrypted. The developer platform is urging all users to rotate stored secrets while it investigates.
Railway said on October 21, 2026, that it had detected anomalous activity involving systems that store customer environment variables. The company’s investigation indicates an unauthorised third party may have accessed encrypted variables and obtained the decrypted contents of some. Railway is asking all users to rotate secrets stored on the platform and review service logs while it continues its investigation.
What may have been exposed
Environment variables are configuration values that software can read while running. They are often used to provide credentials without placing them directly in application code. Railway said these variables may contain API keys, database credentials and private registry credentials. If a credential is exposed, it may provide access to the service or resource for which it was issued, depending on its permissions and whether it remains valid.
Railway said its initial analysis suggests the impact may be limited to a subset of users. The company has not yet finished determining the scope; it said it will contact customers directly by email as it confirms which accounts were affected.
Railway also said it believes the incident may be part of a series of attacks targeting platform companies in an effort to compromise AI inference providers. It said it had notified those upstream providers and asked them to revoke keys proactively.
Railway’s recommended response and service status
The company strongly recommends that all users immediately rotate every environment variable stored in Railway, including API keys and private registry credentials, and check logs for unusual activity. Credential rotation generally involves replacing an existing credential with a new one and ensuring the systems that use it are updated.
Railway has paused all deployments while it investigates. Users cannot roll out new versions until builds are restored. The company said it will post further updates on its announcement and status page.