App-hosting platform Railway has confirmed that an attacker reached a subset of its internal systems and exposed encrypted customer environment variables. For some of those variables, the attacker also got the decrypted contents. Railway first disclosed "anomalous activity" on October 21, 2026, and said then that a third party "may have accessed" the secrets. Its preliminary report on October 22 went further: it confirmed unauthorized access to internal systems and said that "a subset of our customer base had their encrypted secrets exposed." Railway has not said how many customers were affected or how the attacker got in. BleepingComputer puts the platform at about 4.8 million users and more than 16 million hosted services. Railway says the attack was aimed at stealing API keys for AI providers.
What Happened
Railway's preliminary report gives this timeline. All times are UTC.
- Oct 20, 13:58: earliest attacker activity.
- Oct 20, 19:53: Railway "became aware of a sustained and targeted campaign" against its services.
- Oct 21: Railway published its first security disclosure. DeviceCloud, a Railway customer, says it got the notice at 20:44 that evening.
- Oct 22, 03:32: Railway confirmed the attacker no longer had access to any internal system.
The company says it has brought in outside incident response specialists and notified the authorities. It also says the forensic investigation is still going on.
To contain the attack, Railway shut down its build infrastructure. Customers lost builds and deployments, and at times the dashboard, API, CLI and support were also unavailable. Reports differ on how long the outage lasted. TechCrunch called it a brief pause followed soon by restoration. BleepingComputer reported that deployments were paused until the investigation finished. Railway's status page, as cited by BleepingComputer, showed that builds for Pro and Enterprise workspaces were back by 08:44 UTC on October 22. Deployments were still queued at that point, and builds for Hobby, Free and Trial workspaces had not restarted. iSec News reports that service came back tier by tier over October 22.
Two points need to be checked against Railway's own advisory:
- Who should rotate secrets. Press reports, including TechCrunch, BleepingComputer and The Hacker News, quote Railway urging "all users" to rotate. The preliminary report narrows this to "all customers who signed up prior to October 21," and says customers who were directly affected have been notified.
- Whether data was actually taken. The October 21 disclosure only said access was possible. The October 22 report says some secrets were exposed and that internal systems were accessed.
Railway founder and CEO Jake Cooper told TechCrunch that the company will publish a full post-mortem. According to TechCrunch, Railway did not answer questions about the root cause or about whether the attacker had contacted it, for example with a ransom demand.
What Was Taken
The data at risk is customer environment variables. Developers use these to store their applications' credentials, so the exposure can include:
- API keys, including keys for AI inference providers
- Database credentials
- Private container registry credentials, including GitHub access tokens stored as registry credentials
- Keys for cloud storage, payments, email and other services. DeviceCloud's own incident report shows what one customer had stored there.
Railway has not said how many accounts or variables were affected. Railway's own list of breaches this month (S1) records the Railway count only as "subset of users." Some variables were decrypted, but Railway has not said how many.
Security researcher Taylor Monahan, as reported by The Hacker News, says the attackers used the stolen data to drain cryptocurrency wallets whose private keys were stored on Railway. Monahan links the activity to address 0xd9773325282874d18cb83f1fe50f14c39750b2ee. Monahan also reports that the first known theft took place at 7:36 p.m., at least two hours before Railway disclosed the incident. The source does not give a time zone. Railway has not confirmed any financial theft, and only this one source reports it.
Why It Matters
This is a supply-chain compromise in its plainest form. One breach at a hosting platform turns into credential exposure at every customer that keeps secrets there. Whoever holds those secrets can then reach the customers' databases, storage, payment systems and AI accounts and act as the legitimate owner. DeviceCloud's response shows the knock-on cost. It found no sign that its keys had been misused. Even so, it treated every key as leaked and replaced them all, which disrupted its own customers from 07:27 to 11:15 UTC.
A clean log does not show that a secret was never copied. Railway has not said which secrets were decrypted, so any customer who signed up before October 21 should assume its secrets were exposed.
Railway also describes this as a campaign against platforms rather than a single attack on one company. It says the attack was "likely part of a broader attack" aimed at "compromising AI inference providers," and it has told those upstream providers to revoke keys. Databreachradar's roundup also lists another developer platform, Zeabur, on October 19. Zeabur confirmed 3,218,965 environment variable records across 321,810 accounts. No source links the two incidents. Defenders should still expect more attacks on PaaS providers that hold AI API keys.
The Attack Technique
Railway has not said how the attacker got in, which systems were compromised, or the "specific details and scale of the exploits," and has cited the ongoing investigation. What it has said:
- The attacker wanted AI provider API keys in order to run distillation attacks, meaning they wanted to use other people's paid access to frontier models to train or copy models.
- Railway says early evidence suggests the attacker had "abliterated" models (models with their safety refusals removed) and substantial compute. It says this let the attacker carry out "highly sophisticated exploits" against its infrastructure.
Accounts of the motive differ. TechCrunch described the goal as tricking AI systems with malicious prompts into leaking data. Railway itself describes stealing keys for distillation, which is a different goal, and Railway's account should take precedence. Until the post-mortem is published, the initial access vector is unknown.
What Organizations Should Do
- Rotate every secret stored on Railway, not only the ones you think matter. Railway's guidance covers every customer who signed up before October 21. This includes environment variables, database passwords, cloud and AI provider API keys, and private registry credentials. Revoke the old values with each upstream provider. Changing them only inside Railway is not enough.
- Revoke GitHub tokens on GitHub itself. Railway reset the S3 credentials for every storage bucket and invalidated the GitHub tokens it held for account connections. However, the GitHub tokens stored as registry credentials were only removed from Railway, and Railway says they "still work on GitHub until you revoke them." Revoke them, reconnect GitHub, and redeploy any service that reads bucket credentials.
- Replace your Railway API tokens. Railway invalidated all platform API tokens, so CI/CD pipelines and scripts that call the Railway API need new ones.
- Search for misuse from October 20 onward. Check logs for your databases, cloud accounts, AI providers (look for unexpected usage spikes) and payment platforms, starting from 13:58 UTC on October 20. Move any cryptocurrency held by keys that were ever stored on Railway to new keys.
- Check the audit log. Resets made by Railway appear with the actor type "Railway Staff." Export the relevant entries before your plan's retention window deletes them.
- Keep secrets off your hosting platform where you can. Use short-lived credentials, workload identity, or an external secrets manager, and encrypt sensitive data before it reaches the host. DeviceCloud already does this with hashed API keys and client-side envelope encryption.
Sources: Data Breaches October 2026: Full List, Confirmed vs Claimed | Developer platform Railway urges 'all users' to revoke secret keys... | Railway warns devs to rotate secrets after potential breach | Preliminary Report: Oct 21st Security Incident Railway Blog | Security Disclosure Recommendation: Redeploy Buckets and Reconnect... | Incident report: replacing our secrets after Railway's security inc... | Railway Says Intruder May Have Accessed Customer ... | Railway Warns Customer Secrets May Have Been Exposed in Security In...