Railway Security(Compromise) Disclosure

On October 21, 2026, Railway detected anomalous activity involving systems that store customer environment variables and reports that an unauthorized third party accessed encrypted environment variables and, for some entries, obtained decrypted contents. The affected data can include API keys, database credentials, and private registry credentials. Railway characterizes the incident as part of a broader series of attacks against platform companies aimed at compromising AI inference providers and says it has alerted upstream providers to proactively revoke keys.

Railway recommends that all users immediately rotate all environment variables and any private registry credentials stored on the platform and review service logs for unusual activity. All deployments and builds are paused while the company completes its investigation; users cannot roll out new versions until builds are restored. Railway will notify confirmed affected accounts by email, post updates to this announcement and status.railway.com, and has apologized for the inconvenience while stressing it is taking the event seriously.