Railway Warns Users to Rotate Secrets After Potential Environment Variable Exposure
Summary
Railway says an investigation indicates an unauthorized party may have accessed customer environment variables, with some decrypted contents potentially exposed. It urges users to rotate credentials; deployments remain delayed as the investigation continues.
Key points
- Railway detected suspicious activity involving systems that store customer environment variables earlier in the week.
- The company says an unauthorized third party may have accessed encrypted variables and obtained decrypted contents in some cases; the affected scope remains under investigation.
- Environment variables may contain API keys, database credentials, and private registry credentials.
- Railway urged all users to rotate secrets and credentials and check associated service logs for unusual activity.
- Railway said the incident was part of attacks targeting AI inference providers, which it notified and advised to revoke their keys as a precaution.
- Deployments were paused during the investigation. As of October 22, builds had resumed for Pro and Enterprise workspaces, while other workspace tiers were awaiting restoration; deployments remained delayed.
Article Details
- Victim Organization
- Railway
- Incident Type
- Potential unauthorized access to customer environment variables and secrets
- Disclosure Date
- 2026-10-22
- Data Types Exposed
- Environment variables
- API keys
- Database credentials
- Registry credentials
- Operational Impact
- Deployments were paused during the investigation. As of October 22, 2026, builds had resumed for Pro and Enterprise workspaces, while deployments remained delayed and builds had not resumed for Hobby, Free, and Trial workspaces.
- Claim Status
- alleged