> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Railway breach: an attacker may have decrypted customer secrets, and all users are told to rotate keys
- URL: https://www.skimwire.com/railway-breach-customer-secrets-rotate-keys/
- Published: 2026-10-22T19:48:14.000Z
- Updated: 2026-10-22T19:48:14.000Z
- Description: Railway says an attacker may have decrypted some customer environment variables. It wants all users to rotate API keys and database credentials.
- Author: Jeremy Moon
- Tags: Security

## The skim

- Cloud app platform Railway says an attacker may have accessed customers' encrypted environment variables and, for some, decrypted them. Those often hold API keys and database passwords.
- Railway says the impact "may be limited to a subset of users" but is telling every customer to rotate every secret stored on Railway, including private registry credentials, and to check their logs.
- It already reset bucket and GitHub credentials and killed all old API tokens. Builds are back for Pro and Enterprise workspaces, while Hobby, Free and Trial builds and new signups were still paused as of Railway's 19:42 UTC status update on Thursday, October 22.

## What happened

On Wednesday, October 21, Railway "detected anomalous activity involving systems that store customer environment variables," the company wrote in its [security disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st?ref=skimwire.com). Its investigation found that "an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents."

Environment variables are where developers usually keep the secrets their apps run on: API keys, database logins, cloud credentials. Anyone holding them can act as the app's owner. Railway says the attack looks like "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," and that it told those upstream providers to revoke keys proactively. It hasn't said how many customers were hit or how the attacker got in, and founder and CEO Jake Cooper told [TechCrunch](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/?ref=skimwire.com) a post-mortem is coming.

Railway also paused all builds and deployments while it investigated, which meant customers couldn't ship the new credentials they were told to create. Its [status page](https://status.railway.com/incident/QH8L8B3E?ref=skimwire.com) shows the company restoring builds in stages through Thursday: Enterprise first, then Pro. As of its 19:42 UTC update on Thursday, Hobby builds were the current focus, with Free and Trial to follow, and new signups were temporarily paused. Railway said it would post its next update by 20:30 UTC.

## Who it affects

Anyone with an app on Railway, from solo developers to startups. Security researcher Taylor Monahan says the attacker also drained crypto wallets whose private keys were stored on Railway, [The Hacker News](https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html?ref=skimwire.com) reports. Railway hasn't confirmed that.

## What to do now

- **Rotate everything** stored as a Railway variable: AI provider keys (OpenAI, Anthropic, OpenRouter and others), Stripe keys, database passwords, AWS and Google Cloud credentials. Railway has published step-by-step guides for each.
- **Check usage dashboards** at your AI and payment providers for spending you don't recognize. Stolen AI keys are valuable because anyone holding one can run models on your bill.
- **Redeploy services that use Railway storage buckets**, since Railway [reset those credentials](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset?ref=skimwire.com) and containers only read new values at startup.
- **Reconnect GitHub**, and delete any GitHub personal access tokens you'd stored on Railway for its container registry. Railway removed them, but they still work on GitHub until you revoke them.
- **Make new Railway API tokens**, because every token created before the incident has been invalidated.

## Why it matters

Hosting platforms hold the keys to many other services, so one break-in can spread far beyond the company that was hit. Railway isn't the only one this week: the open source AI coding tool OpenCode said hackers took more than 1% of its customers' API keys and other secrets in a similar attack, TechCrunch reports. Railway's story isn't finished. The size of the breach, how the attacker got in and any confirmed abuse of stolen keys should come in its promised post-mortem.

*Sources:* [*Railway security disclosure*](https://blog.railway.com/p/security-disclosure-wednesday-october-21st?ref=skimwire.com)*,* [*Railway status page*](https://status.railway.com/incident/QH8L8B3E?ref=skimwire.com)*,* [*Railway guide: buckets and GitHub*](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset?ref=skimwire.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/?ref=skimwire.com)*,* [*The Hacker News*](https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html?ref=skimwire.com)*.*