Was my Railway project affected by the October 2026 breach?

Railway says its first analysis suggests the impact may be limited to a subset of users, and it will email affected customers as it confirms them. Railway still asks every user to act as a precaution, because the investigation is ongoing and the full scope of the environment-variable breach is not yet known.

Which secrets should I rotate after the Railway breach?

Railway asks users to roll all environment variables stored on the platform, including API keys, and to roll any private container registry credentials. On October 22 Railway also invalidated every Railway API token, so anyone using the Railway Public API must create new tokens. Users should then review their service logs for unusual activity.

Why does the Railway breach matter for AI API keys?

Railway believes the intrusion is part of a wider series of attacks on platform companies that aims to compromise AI inference providers. Developers often store model API keys as environment variables, so those keys are a direct target. Railway has told the upstream providers so they can revoke exposed keys proactively.

How do I check a Google Cloud key that was stored in Railway?

Railway's Google Cloud guide says to create a replacement service account key, disable the exposed one with gcloud, and deploy the new key to Railway. It then says to review Cloud Audit Logs for the exposure window, look for new service accounts, keys, IAM bindings or Compute instances, and compare billing for Compute, GPU and Vertex AI.

Railway · 2026-10-21 · major

Railway breach — attackers read customer secrets to reach AI providers

Railway says an attacker accessed stored environment variables, and decrypted some of them. It links the attack to a wider campaign against platforms that aims at AI inference providers. All users should rotate their secrets.

Railway blog banner for its October 21, 2026 security disclosure

A hosting platform breach puts stored API keys at risk, and the attacker appears to be hunting AI provider access.

Quick facts

Disclosed	October 21, 2026
Data exposed	Environment variables, some decrypted
Likely target	AI inference providers' keys
Deployments	Paused platform-wide during the investigation
Railway API tokens	All invalidated on Oct 22
What to do	Rotate every secret stored in Railway

What is it?

Railway, a cloud platform for deploying apps, disclosed on October 21, 2026 that an unauthorized third party may have accessed the encrypted environment variables of its customers. For some of those variables, the attacker also obtained the decrypted contents, which can include API keys and database or registry credentials.

How does it work?

The attacker went after the systems where Railway keeps customer environment variables. Railway believes this break-in is one step in a broader campaign against platform companies, with the end goal of reaching AI inference providers through the keys their customers store. In response, Railway paused all builds and deployments, notified upstream providers so they could revoke keys, and later invalidated all of its own API tokens.

Why does it matter?

Many AI apps keep model provider keys in environment variables, so a single hosting breach can expose keys for several AI services at once. Teams that deploy on Railway need to rotate every stored secret now, check provider dashboards and cloud bills for unexpected use, and plan for slower deploys while the platform recovers.

Who is it for?

teams hosting apps on Railway

Frequently asked questions

Was my Railway project affected by the October 2026 breach?: Railway says its first analysis suggests the impact may be limited to a subset of users, and it will email affected customers as it confirms them. Railway still asks every user to act as a precaution, because the investigation is ongoing and the full scope of the environment-variable breach is not yet known.
Which secrets should I rotate after the Railway breach?: Railway asks users to roll all environment variables stored on the platform, including API keys, and to roll any private container registry credentials. On October 22 Railway also invalidated every Railway API token, so anyone using the Railway Public API must create new tokens. Users should then review their service logs for unusual activity.
Why does the Railway breach matter for AI API keys?: Railway believes the intrusion is part of a wider series of attacks on platform companies that aims to compromise AI inference providers. Developers often store model API keys as environment variables, so those keys are a direct target. Railway has told the upstream providers so they can revoke exposed keys proactively.
How do I check a Google Cloud key that was stored in Railway?: Railway's Google Cloud guide says to create a replacement service account key, disable the exposed one with gcloud, and deploy the new key to Railway. It then says to review Cloud Audit Logs for the exposure window, look for new service accounts, keys, IAM bindings or Compute instances, and compare billing for Compute, GPU and Vertex AI.

Try it

Rotate every Railway environment variable, then follow Railway's AWS and GCP access-check guides