---
title: 'Railway platform breach exposes decrypted environment variables; all users told to rotate secrets'
url: 'https://securteksecurity.com/news/railway-platform-breach-environment-variables-decrypted-rotate-secrets'
markdown: 'https://securteksecurity.com/news/railway-platform-breach-environment-variables-decrypted-rotate-secrets.md'
date: '2026-10-22'
description: 'Railway disclosed on October 21, 2026 that it detected anomalous activity that morning in the systems that store customer environment variables. An unauthorized party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents, which can include API keys…'
taxonomy:
  category:
    - Cybersecurity
---

# [Railway platform breach exposes decrypted environment variables; all users told to rotate secrets](https://securteksecurity.com/news/railway-platform-breach-environment-variables-decrypted-rotate-secrets)

   22nd Oct 2026  

Railway disclosed on October 21, 2026 that it detected anomalous activity that morning in the systems that store customer environment variables. An unauthorized party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents, which can include API keys and database and registry credentials. Railway believes the impact is limited to a subset of users but told all customers to rotate every stored secret, and it links the attack to a series of attacks on platform companies aimed at compromising AI inference providers.

Railway paused deployments platform wide, invalidated OAuth sessions, rotated storage bucket credentials, published 13 rotation guides, and on October 22 invalidated all Public API tokens at 04:17 UTC. Builds returned in stages, Enterprise first at 03:32 UTC on October 22. No confirmed record count or customer count has been stated, so this is prepared as a Cybersecurity item, not a Breaches add. A researcher estimate of crypto losses from stored private keys is not carried, as Railway has not confirmed it.

Update, October 24: Railway's preliminary report, published on October 22, 2026 and linked from its status page on October 23, puts an upper bound on the scope and confirms the attacker's objective. Railway says the attack ran from October 20 at 13:58 UTC to October 22 at 03:32 UTC, when it confirmed the attacker no longer had access, moving from a build infrastructure privilege escalation to CI environment credentials that were used to decrypt a subset of queried encrypted environment variables. At most 1.85 percent of all workspaces, about 100,000 workspaces, had some environment variables potentially compromised, stated as an upper bound for potential exposure, not a count of confirmed victims. The objective was AI provider API keys to perform distillation attacks. Railway says user accounts were not accessed, source code access is not ruled out, and all users who stored secrets before October 21 should rotate them. It worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe and others to revoke potentially compromised keys.

Sources: [Safeguard](https://safeguard.sh/resources/blog/railway-environment-variables-breach-october-2026); [GitGuardian](https://blog.gitguardian.com/railway-october-2026-incident-environment-variables/); [The Hacker News](http://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html); [Safeguard](https://safeguard.sh/resources/blog/railway-preliminary-report-ci-credentials-ai-key-theft)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Quest Diagnostics says unauthorized party accessed Quanum LSM system and certain patient records](https://securteksecurity.com/news/quest-diagnostics-quanum-lsm-unauthorized-access-patient-records.md)
- Next: [Rakuten Travel unauthorized access may have exposed up to 2.6 million records](https://securteksecurity.com/news/rakuten-travel-unauthorized-access-up-to-2-6-million-records.md)