Railway Warns of Possible Customer Secret Exposure as Deployment Pause Hampers Rotation

Railway disclosed a security incident on October 21 involving possible unauthorized access to customer environment variables, including some decrypted values that could expose API keys, database passwords, and private registry credentials. The company urged all customers to rotate stored secrets and inspect connected services for suspicious activity rather than wait for confirmation that their accounts were affected. Railway has not identified the attacker, disclosed the access method, or confirmed downstream misuse; its investigation and identification of affected accounts remain ongoing.

Railway paused deployments during the investigation, preventing customers from rolling out replacement credentials to their applications. Builds remained unavailable at 02:19 UTC on October 22, and the company is also rotating all storage bucket credentials. Railway believes the incident may be connected to attacks against platform companies intended to compromise AI inference providers, but that connection remains unconfirmed. Customers face both potential credential exposure and operational disruption while deployment capabilities remain restricted.