Railway: your .env went for a ride without you

Railway, a popular platform-as-a-service, initially said that on the morning of October 21, 2026 it detected unusual activity in the systems that store customer environment variables. That initial notice said an unauthorized party may have accessed the encrypted variables and, for some of them, obtained the decrypted contents. On Railway, environment variables are where apps keep their API keys, database passwords and registry credentials, so this is effectively a secrets store.

Railway believes the intrusion is part of a recent series of attacks on platform companies whose goal is to get at AI inference providers. It says it has asked those upstream providers to revoke keys proactively. The initial notice did not name them; its preliminary report identifies GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI and Stripe among notified providers. Its usage-check guides also cover Grok.

What Railway did on its side

• Paused new builds and deployments during triage, including earlier October 20 interruptions. Builds came back for Enterprise around 03:30 UTC on Oct 22, with other plans following in stages.
• Invalidated OAuth sessions (users get logged out).
• Reset every storage bucket’s S3 credentials and the GitHub tokens Railway held for account connections, and removed GitHub tokens stored as registry credentials. These resets show in workspace audit logs under “Railway Staff”.
• Asked upstream providers to revoke keys; the initial notice left them unnamed, and the preliminary report now identifies several.

Railway can’t rotate your third-party secrets for you: the Stripe key, the OpenAI key and the database password in your variables are yours to roll. And because containers only read variables at startup, any rotation needs a redeploy, which was impossible while builds were paused.

Why L4

Railway says the impact “may be limited to a subset of users”, yet tells all users to rotate. It confirms that decrypted secrets were obtained for at least some customers. A breach of a multi-tenant secrets store at a large PaaS is a mass credential leak, and each leaked key opens a different downstream system. That is L4. It would move up if large-scale abuse of the stolen keys were confirmed.

What’s still unclear

• Initial entry and exact exploit details remain undisclosed. The preliminary report describes privilege escalation and compromised CI credentials.
• Exactly which variables were decrypted remains unknown; the workspace upper bound does not answer that. Broad provider revocations do not establish compromise of every reset credential.
• Railway says individual user accounts were not accessed; source-code access is still not ruled out.
• Misuse. Railway now gives a process for customers seeking refunds for fraudulent AI spend. That guidance does not publish a verified misuse count or attribute every suspicious charge to this intrusion; check your own provider logs.

Correction, October 24: Railway’s October 22 preliminary report supersedes the earlier unknown-scope account: at most 1.85% of workspaces (about 100,000) potentially had variables compromised. This is an upper bound, not a confirmed-victim total. It dates the attack window to October 20, 13:58 UTC through October 22, 03:32 UTC, and says existing workloads stayed online. All plan tiers accept builds again. The October 23 guides explain how to catch up missed deployments and replace revoked access; use the original login identity if projects appear missing.

Update, October 27: Railway’s October 26 update says services are fully restored for existing users, while new signups remain paused. Recovery does not replace the credential rotation and deployment-recovery steps above. For suspected fraudulent AI charges, contact the AI provider first, then submit timestamps, prompts and supporting proof at Railway Station for escalation. Railway cannot refund third-party AI spend, and its escalation offer is not a refund guarantee. No verified downstream-abuse total or broader victim count is established by this update.