Science & Tech · Cybersecurity · 6 hrs ago
Railway urges all users to rotate credentials after cyberattack
Railway says a cyberattack may have exposed customer secrets stored on its cloud platform for building and running apps.
These secrets are kept in environment variables and can include API keys, passwords and database credentials used by apps to access other services.
The company says only a subset of users may be affected, but it has not said how many or explained how the attack happened.
Railway is urging all users to rotate their keys and credentials and check service logs for unusual activity.
Deployments were paused during the investigation, though builds had resumed for Pro and Enterprise workspaces by October 22, while deployments remained delayed and other plans were still waiting for builds to return.
Railway says it will notify users whose accounts are confirmed compromised and share more details as its investigation continues.
Railway urged all users to rotate secrets and credentials after detecting suspicious activity involving systems that store customer environment variables.
The company said an unauthorized third party may have obtained decrypted contents of some variables.
Railway’s initial analysis suggested that only a subset of users may have been affected, but it did not disclose how many.
The company paused customer deployments while it investigated the incident.
Railway said the attack was likely part of a broader campaign targeting AI inference providers.
- Who
- Railway and users of its cloud development platform.
- What
- Railway said an unauthorized third party may have accessed customer environment variables and obtained some decrypted contents. It urged all users to rotate secrets and credentials.
- When
- Railway detected suspicious activity earlier in the week. Its warning was reported on October 22, 2026.
- Where
- Railway’s systems that store customer environment variables.
- Why
- Railway said the incident was likely part of a broader attack targeting AI inference providers. The attack’s root cause was not stated.
This story does not have two clearly opposing sides.
Railway detected suspicious activity on systems that store customer environment variables.
Railway said in a blog post that an unauthorized third party may have accessed encrypted environment variables and obtained some decrypted contents.
Railway’s status page said builds had been restored for Pro and Enterprise workspaces, while deployments remained delayed and queued.
- Users
- Around 4.8 million
- Hosted services
- More than 16 million
- Potentially exposed data
- Environment variables containing secrets such as API keys and database or registry credentials
- Deployment status
- Paused during the investigation
- Affected users
- Railway did not state how many accounts were affected
3 sources
What people are saying
Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents
Environment variables may contain secrets such as API keys or database and registry credentials