Railway's October 2026 security incident
On October 21, 2026 Railway disclosed that an unauthorized third party may have read customers' environment variables, and paused builds and deploys on every plan. This page keeps the timeline, what is confirmed and what is not, and the rotation checklist in one place.
Railway says an attacker may have accessed encrypted environment variables and, for some, the decrypted values. It tells every customer to rotate every variable and registry credential, has invalidated all OAuth sessions and API tokens, and is bringing builds back plan by plan. Rotate at the provider that issued each key, not only in Railway: checklist below.
Timeline · all times UTC
How October 21 and 22 unfolded
Railway opens a status incident and starts investigating.
Dashboard, API and CLI unavailable; new builds paused in all regions. The support site is down too.
First crypto theft that investigator Taylor Monahan ties to the incident: about $371,000 across 500+ transactions on at least 19 EVM chains, per crypto.news. Railway has not confirmed the link or the figure.
Public disclosure. Railway tells all users to roll every environment variable and private registry credential and to review logs. OAuth sessions are invalidated, so users are signed out.
Railway rotates every storage bucket credential. New values appear in the dashboard, but with builds paused nobody can redeploy to pick them up.
Step-by-step guides for AWS, Google Cloud, GitHub, Stripe, OpenAI, Anthropic, OpenRouter, Grok, Postgres, MySQL, MongoDB and Redis credentials, e.g. AWS and Google Cloud.
Builds come back for Enterprise workspaces.
All Railway API tokens invalidated. Anything that calls Railway's public API needs a new token.
Builds come back for Pro. As of 08:01 UTC, Hobby, Free and Trial are still waiting, and many deploys stay queued longer than usual; Railway asks users not to trigger the same deploy twice.
From Railway's disclosure and status page unless marked otherwise. Updated when Railway posts news or its postmortem.
If you are on Railway right now
- Revoke at the source, not just in Railway. Editing a variable on Railway does not kill the old value. Deactivate the AWS key, disable the GCP service account key, roll the Stripe and AI provider keys, change the database password, then put the new values in.
- Check the bills that attackers go for. Railway's guides single out OpenAI, Anthropic, OpenRouter and Grok usage, plus compute, GPU and Vertex AI spend on Google Cloud. Compare the exposure window with the previous month.
- Look for persistence, not just usage. New IAM users, access keys, roles and project-level SSH keys created with a leaked credential keep working after you rotate the original.
- Replace your Railway API tokens and redeploy once builds return for your plan, so services pick up the rotated bucket credentials and your new values.
Confirmed so far
What was exposed: encrypted customer environment variables, and for some of them the decrypted values. That is where Railway users keep database passwords, cloud keys, payment and AI provider keys.
Who did it: unknown. Railway links it to a series of recent attacks on platform companies aimed at AI inference providers, and says it asked those providers to revoke keys proactively.
What Railway changed: paused builds and deploys, signed everyone out, rotated storage bucket credentials and invalidated every API token.
Not known yet
How the attacker got in, how many customers were affected (Railway says possibly a subset and will email them), and whether the roughly $371,000 crypto theft an investigator ties to the incident came from Railway-stored keys. Railway has confirmed none of these.
Common questions
The incident: common questions
Was my Railway project affected?
Railway says the impact may be limited to a subset of users and that it will email affected customers directly. It has not published how many. Until you hear otherwise, treat every variable stored in Railway as exposed and rotate it.
What should I rotate after the Railway incident?
Every environment variable and private registry credential stored in Railway: cloud keys (AWS, Google Cloud), database passwords, Stripe, GitHub and AI provider keys. Revoke each one at the provider that issued it, check that provider for usage you did not generate, then redeploy on Railway with the new values once builds are back for your plan. Railway API tokens were already invalidated, so create new ones.
Are Railway deploys working again?
Partly. As of 08:01 UTC on October 22, builds were back for Enterprise (since 03:32 UTC) and Pro (since 06:29 UTC), while Hobby, Free and Trial were still waiting and many deploys stayed queued longer than usual. Railway asks users not to trigger the same deploy more than once.