Railway discloses unauthorized access to customer environment variables

Teaser from the source

On Oct 21 2026 Railway disclosed that an attacker had accessed internal systems storing customer environment variables. In its Oct 22 preliminary report, Railway says the attack ran from Oct 20 13:58 UTC to Oct 22 03:32 UTC, apparently aimed at stealing AI provider API keys for distillation; the attacker pulled encrypted env vars, then used CI credentials to decrypt a subset. At most 1.85% of workspaces (about 100,000) had some variables potentially compromised; user accounts were not accessed, and source-code access is not yet ruled out. Railway asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe and others to revoke keys, rebuilt its tooling, moved builds to single-tenant infrastructure, and says builds and the API are fully restored. All customers who signed up before Oct 21 are told to rotate secrets stored on Railway.

This is the RSS-feed teaser. Read the full article at the original source.