Railway breach: customer environment variables exposed
An intruder may have read environment variables stored on Railway, including API keys and database passwords. Railway asks every customer to rotate them.
What happened
On 21 October 2026, Railway detected unusual activity in the systems that store customer environment variables. It says an unauthorized party may have accessed encrypted variables and, in some cases, their decrypted contents.
Railway paused deployments, reissued its own storage credentials and signed some users out. It says a subset of users is affected and will email the ones it confirms. It hasn't said how many, or how the attacker got in.
Railway suspects the attack is part of a wider campaign to get access to AI inference providers, so AI API keys are a likely target.
Who is affected
- Any app with environment variables stored on Railway: API keys, database passwords, auth secrets, private registry credentials.
- Don't wait for Railway's email. Treat every secret stored there as exposed until it's rotated.
How to check
- List what you stored: in Railway open each service's Variables tab, or run railway variables in each project.
- Paste the names below to get them ranked: what to rotate first and where.
- Look at usage on your AI provider, Stripe and cloud dashboards for the last few days, and at your service logs for requests you don't recognise.
Only the names are used. Nothing you paste leaves this browser tab.
How to recover
- Rotate in the order below: anything that moves money or gives full control first (wallets, Stripe, database, AI keys, cloud and GitHub tokens).
- Put the new values in Railway, redeploy, and only then revoke the old ones, so the app doesn't go down in between.
- Regenerate your app's own signing secrets last. That signs everyone out, which is what you want after a leak.
- Set spending limits on AI provider and cloud accounts so the next leaked key can't run up a bill.
- Scan the app afterwards to make sure no new key ended up in the browser bundle.
Check your app
Free and read-only. Before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.