// RailwayCRITICAL
Railway detected unauthorized access to systems storing customer environment variables on October 21, 2026. An attacker decrypted some stored environment variables including API keys and database credentials. All deployments were paused during investigation. The incident is part of a coordinated campaign targeting platform companies with the aim of stealing API keys to frontier AI providers (Anthropic, OpenAI) for model distillation. Railway advises all customers to immediately rotate API keys, database credentials, and registry secrets, and review downstream services for unauthorized activity.
- Security Disclosure: Wednesday October 21st | Railway Blog(opens in a new tab)
- Railway Breach: Stolen Anthropic and OpenAI API Keys Fuel a Blac(opens in a new tab)
- Railway Urges All Users to Rotate Secrets After Security Inciden(opens in a new tab)
- Railway Security Incident: Hackers May Have Accessed Customer En(opens in a new tab)
- New Railway Incident: Treat Every Env Variable as Exposed(opens in a new tab)
- Railway warns devs to rotate secrets after potential breach(opens in a new tab)
// Get alerts for Railway