Railway breach exposed decrypted secrets; rotate everything

Platform-as-a-service provider Railway disclosed on 21 October 2026 that an unauthorized third party reached systems storing customer environment variables — and, for some of them, obtained the decrypted contents. Environment variables on Railway routinely hold API keys, database credentials and private registry tokens, so the practical impact for affected users is a full secret-rotation event. Railway's security disclosure is the primary source.

What happened

Railway detected anomalous activity involving the systems that store customer environment variables. Its investigation to date indicates an attacker may have accessed encrypted environment variables and, for a subset, obtained the decrypted contents. Railway has not published a user count or a root cause. It says the incident is likely part of a broader campaign targeting platform companies, with the apparent end goal of compromising AI inference providers.

Independent researcher Taylor Monahan, cited by The Hacker News, linked the activity to an Ethereum wallet that drained crypto wallets whose private keys had been stored on Railway, with a theft logged at 7:36 p.m. — at least two hours before Railway's public disclosure. No group has claimed responsibility.

What Railway has already done

• Invalidated all Railway API tokens. Public-API integrations stop working until you create new tokens.
• Rotated all storage-bucket credentials.
• Paused builds and deployments during response — which means you can't redeploy to pick up rotated secrets until builds are restored.
• Notified upstream providers so they could proactively revoke keys, and published provider-specific guides for checking misuse (AWS, GCP, OpenRouter, Stripe, Anthropic).

Action checklist

1. Rotate every secret stored in Railway — API keys, database credentials, private registry tokens, signing keys — from a clean environment. Treat anything that lived in a Railway environment variable as exposed.
2. Recreate Railway API tokens for any integration that used the public API; the old ones are dead.
3. Hunt for misuse at each provider. Use Railway's per-provider guides: review CloudTrail/billing (AWS), audit logs (GCP), and usage dashboards (OpenRouter, Stripe, Anthropic) for activity you didn't generate.
4. If you stored wallet private keys or signing material on Railway, assume theft and move funds/keys now — this is already how the first losses occurred.
5. Watch the Railway status page and the disclosure post for the affected-account notifications and the build restore.

Context

This is the second platform-secrets breach we've covered this month after Zeabur, and the pattern is the same: the value isn't the platform, it's the pile of downstream provider credentials its customers hand it. A PaaS that decrypts environment variables to inject them at build time holds the keys to everyone's cloud, and that concentration is exactly what makes it worth an attacker's time. If you depend on a secrets-holding platform, your incident response now has a dependency you don't control — plan for the day its builds are paused and you can't rotate through it.