Railway Tells All Users to Rotate Keys After Hackers Decrypted Customer Secrets
Railway says hackers may have decrypted some customer environment variables containing passwords and API keys, though the breach appears limited to a subset of users. All users should rotate keys after deployments were paused on October 22, 2026.
Cloud development platform Railway confirmed on October 22, 2026 that a cyberattack allowed hackers to access and decrypt some customer secrets, and urged all users to immediately revoke and rotate their API and cloud keys.
The company said in a blog post that unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” These environment variables typically contain passwords and API keys that developer apps use to access external services such as cloud storage and databases. An attacker in possession of these secrets could potentially access data as if they were the legitimate account owner.
Railway said its initial analysis suggests the breach was limited to a “subset of users,” but recommended that all users rotate their keys as a precaution. The company also paused customer deployments during its investigation, effectively freezing customer websites and apps. Railway did not disclose how many users were affected or identify the root cause of the incident.
The company said the breach was likely part of a broader attack targeting platforms “with the aim of compromising AI inference providers” — attacks that involve tricking AI systems into leaking sensitive data through malicious prompts. Railway did not confirm whether it received any ransom demand from the attackers.
The incident follows a similar attack disclosed earlier in the week by open source AI coding tool OpenCode, which reported that hackers obtained more than 1% of its customers’ API keys and other secrets. OpenCode attributed that attack to an AI distillation attack, where large numbers of agents attempt to extract sensitive information from AI models. The U.S. cybersecurity agency CISA has also recently warned that China-based AI companies are conducting large-scale attacks on U.S. firms to improve their own models.
For Railway’s customers, the immediate risk is that stolen keys could allow unauthorized access to connected services and data until those credentials are revoked.