Railway says its security breach potentially compromised environment variables in about 100,000 workspaces, or at most 1.85% of its total. In incident updates on October 23, 2026, the cloud development platform linked its preliminary findings and renewed calls to rotate sensitive credentials. It later reported normal operation of builds, deployments, its API and dashboard.

The provider first disclosed suspicious access to systems storing customer environment variables on October 21. These values can include API keys, database passwords and private registry credentials, according to Railway's disclosure, also reported by BleepingComputer. The exposure therefore concerns secrets used by applications to connect to other services, rather than configuration settings alone.

Railway's preliminary timeline says the intruder obtained encrypted secrets and subsequently accessed credentials for its continuous integration environment. Compromised credentials enabled decryption of a subset of environment variables. The company says it could not determine exactly which keys within affected projects were decrypted and has not disclosed the specific exploits while its investigation continues.

Early findings suggest the attacker sought AI provider API keys for distillation attacks, Railway said. That remains the company's assessment of intent. Railway dates the intrusion window from October 20 at 13:58 UTC to October 22 at 03:32 UTC, when it confirmed the attacker no longer had internal access. It says existing customer deployments stayed online while new builds were interrupted.

At 19:18 UTC on October 23, Railway said it had completed notifications for workspaces meeting its increased-risk criteria. It cautioned that other workspaces were not confirmed safe from compromise. Its 22:06 UTC update marked the platform outage resolved, although new registrations remained paused and the support and community site was still unavailable.

Railway's October 23 guidance asks customers to revoke and replace sensitive credentials stored before October 21, remove public database access, and review GitHub and container registry audit logs. Its status update also calls for redeploying dependent services and checking provider activity for suspicious usage. Customers who completed rotations after containment do not need to repeat them solely because of that update; the forensic investigation remains ongoing.