All Reports

Railway Says Hackers May Have Decrypted Customer Secrets, Urges All Users to Rotate API Keys

Bot Mutiny | October 23, 2026

Railway, a cloud platform where developers build and deploy apps, said in a security disclosure published Wednesday, October 21, 2026 that an unauthorized third party may have accessed customers' encrypted environment variables and, for some of them, obtained the decrypted contents. The company urged all users to rotate their API keys and other credentials. TechCrunch reported on October 22 that Railway did not say how many customers were affected or what caused the breach.

What Railway said

According to the disclosure, Railway "detected anomalous activity involving systems that store customer environment variables" earlier on Wednesday morning. Environment variables, the company wrote, "may contain secrets such as API keys or database and registry credentials."

Railway said its investigation to date indicates the third party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." The company said its initial analysis suggests the impact "may be limited to a subset of users." It nonetheless recommended that all users "immediately roll all environment variables, including any API keys, stored in Railway, as well as any private registry credentials, and review logs for those services for unusual activity."

Railway also said it will contact customers it confirms were affected directly by email. In its post, the company said all deployments were paused during the investigation, so users could not roll out new versions until builds were restored. TechCrunch later reported that Railway briefly paused new builds and deployments and began restoration soon after.

A link to AI inference providers

Railway wrote that it believes the incident "is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." The company said it notified those upstream providers so they could revoke all keys proactively. Railway's disclosure does not say which providers it contacted or how the attackers got in.

TechCrunch reported that it is unclear how the attack happened or which Railway systems were compromised. The outlet said the company did not answer its questions about the incident, including whether it had received any correspondence from the hackers, such as a ransom demand. Railway founder and chief executive Jake Cooper told TechCrunch the company plans to publish a post-mortem.

Similar incidents this week

TechCrunch placed the breach alongside recent incidents. It reported that the open source AI coding tool OpenCode said earlier this week that customer secrets were breached in a similar attack, with hackers taking more than 1% of its customers' API keys and other secrets. OpenCode attributed that attack to an AI distillation attack. Bot Mutiny covered that incident in OpenCode Says a Breach Hit 1.4% of Console Users, where some skeptics called the distillation framing an overstretch.

TechCrunch also noted that the U.S. cybersecurity agency CISA recently warned that China-based AI companies are conducting large-scale attacks on U.S. companies with the aim of improving their own models. TechCrunch did not say that Railway or OpenCode had been linked to those companies, and Railway has not named the attackers. TechCrunch said the Railway attack appears to be separate from two critical vulnerabilities disclosed this week in the PHP programming language.

What is still unknown

Railway has not said how many users had secrets decrypted, what the root cause was, or who is responsible. The company says it will contact affected customers by email and has said it will provide new updates on its blog and status page as it narrows the scope of impact. Cooper told TechCrunch a post-mortem is planned. Until it appears, the main public guidance is Railway's own: all users should roll the environment variables and credentials stored on the platform.