Short answer
Railway said an attacker escalated privileges through its build infrastructure on 20 October 2026, then pulled encrypted secrets and obtained CI credentials. Its preliminary report says some environment variables were decrypted and tells customers to rotate anything stored before 21 October.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Railway |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Cloud hosting and developer platform |
| Country | United States |
| Detected | 2026-10-20 |
| Disclosed | 2026-10-21 |
| People or records affected | A subset of workspaces: at most about 1.85% (roughly 100,000), per Railway's preliminary report |
What data was exposed
- Encrypted environment variables for a subset of workspaces, some of which were decrypted
- API keys, database credentials and registry credentials that customers stored as environment variables
- Railway has not ruled out access to some user source code
What happened
Railway, a platform that hosts apps and databases for developers, published a preliminary report on its October 2026 security incident. It says it became aware of a “sustained and targeted campaign” on 20 October and that the attack window began earlier that day. BleepingComputer reported it on 22 October, noting the platform has about 4.8 million users.
According to the report, the attacker escalated privileges through Railway’s build infrastructure and then reached internal systems and CI credentials. Railway has not published the specific exploit.
What the attacker took
On 21 October, the report says, the attacker pulled encrypted secrets, then used CI credentials to decrypt some artifacts and environment variables. Environment variables are where developers commonly keep API keys, database passwords and registry logins.
Railway estimates that at most about 1.85% of workspaces, roughly 100,000, may have had some variables compromised. It could not determine exactly which variables were decrypted. So it notified vendors to revoke “all of the keys we stored, for all users on Railway,” and provider reset requests exceeded 100,000.
Railway says user accounts were not accessed, and it has not ruled out access to some user source code.
Who was targeted
Railway’s logs suggest the attacker was looking for AI provider API keys, possibly for distillation attacks. BleepingComputer describes it as one of a series of attacks aimed at AI inference keys. That is Railway’s reading of the logs, not a confirmed attribution, and no group has been named.
Timeline and response
Railway halted build pipelines on 20 October and declared an incident. It confirmed on 22 October at 03:32 UTC that the attacker no longer had access to internal systems, then restored its API and normal deployments through that day. It invalidated user sessions, rolled credentials for storage buckets and GitHub App installations, rebuilt tooling from validated source and moved builders to a new single-tenant design. An outside forensics firm and authorities are involved. A final report is promised.
What to do if you host on Railway
Railway’s advice, repeated in its 23 October changelog, is to rotate anything stored before 21 October, strip public access from databases and review GitHub and registry audit logs. Commits pushed during the pause were not deployed, so some users must reconnect GitHub and redeploy.
This was one of several developer platform incidents in the same fortnight. See also the OpenCode Console breach.
Start with our data breach checklist. Fake security notices from a hosting provider fit the pattern in our guide to phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as Railway support or security that ask you to log in or reconnect GitHub through a link.
- Unauthorized spending on your AI provider accounts from stolen API keys, followed by fake 'refund' contacts.
- Attempts to reach your databases or cloud accounts with leaked credentials, which can lead to extortion messages.
What to do if you are affected
- 01Rotate every secret stored on Railway before 21 October 2026: API keys, database passwords, tokens and registry credentials.
- 02Remove public network access from your databases.
- 03Review your GitHub audit logs and installed apps, and your container registry audit logs, for activity you do not recognize.
- 04Check AI provider billing for spend you did not make and contact the provider directly if you find any.
- 05Reconnect GitHub and redeploy your latest commit if deployments fail, and recreate CLI and CI credentials.
Frequently asked questions
How many Railway customers were affected?
Railway's preliminary report says at most about 1.85% of workspaces, roughly 100,000, may have had some variables compromised. It could not tell which variables were decrypted, so it asked vendors to revoke all keys it stored.
Were Railway user accounts accessed?
Railway says user accounts were not accessed. It has not ruled out access to user source code, and its investigation is still running.
Did my apps go offline?
Running services stayed online, according to Railway. Builds and deployments were paused, and BleepingComputer reported that builds returned in stages from 22 October. Railway said full restoration for existing users came on 26 October, with new signups still paused.
Will Railway refund fraudulent AI charges?
Railway says it cannot refund spend made with compromised keys. Contact the AI provider first, then send Railway a request with timestamps and evidence.
Sources
- Preliminary Report: Oct 21st Security Incident, Railway, 2026-10-22
- Railway warns devs to rotate secrets after potential breach, BleepingComputer, 2026-10-22
- October 21 security incident, Railway changelog, 2026-10-23
This post summarises public reporting as of 2026-11-05. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.