Railway cloud platform breach exposes customer API keys and database credentials

Cloud application deployment platform Railway disclosed a security incident on October 21, 2026, after detecting unauthorized access to the internal systems that store customer environment variables — configuration values that frequently contain API keys, database connection strings, and private package registry credentials. Railway said an unauthorized third party may have accessed encrypted variables and, in some cases, obtained their decrypted contents.

Railway paused all builds and deployments across the platform — including for enterprise customers — revoked and reissued storage bucket credentials, notified upstream AI inference providers to proactively revoke keys, and said it would contact affected users directly by email. Railway CEO Jake Cooper described the incident as malicious activity that compromised Railway's servers. The company's initial analysis indicates the impact may be limited to a subset of users, but it has told every customer to treat all stored secrets as potentially exposed. Railway said it believes the attack is part of a broader campaign targeting platform companies with the goal of reaching AI inference providers. Whether downstream end-users of applications hosted on Railway were affected depends on whether attackers used obtained credentials to access those applications' data, which had not been publicly confirmed as of October 22.

Any organization with workloads, applications, or CI/CD pipelines hosted on Railway should rotate all stored secrets immediately — API keys, database passwords, registry tokens — regardless of whether they receive a direct notification. It is also a good time to review audit logs for unusual access and to consider whether any credentials stored on the platform have been reused elsewhere.