Railway data breach

Railway announced a data breach on Oct 21, 2026, exposing passwords. The number of people affected has not been disclosed. It was caused by a cyberattack. No settlement or compensation has been announced.

What happened

Cloud app-hosting platform Railway disclosed on October 21, 2026 that an attacker may have accessed encrypted customer environment variables and decrypted some of them, and told all users to rotate stored secrets such as API keys, database passwords and private registry credentials. Its November 10 incident report says the attacker exploited a previously unknown flaw in Railway's build infrastructure on October 20, then used a misconfigured cloud credential to reach the key service; at most 1.85% of workspaces (about 100,000) could have had variables decrypted, and linked-account tokens of 1,852 users were reset. The attacker mainly searched for AI provider keys, and Railway estimates about $740,000 in unauthorized spending on stolen keys, which it says it is working to get refunded or will cover. Railway found no logins to its accounts with stolen credentials and no sign that customer databases were accessed.

What should I do?

1. Rotate every secret you stored in Railway environment variables (AI provider, cloud, database, payment and registry keys), revoke the old values, and redeploy.
2. Check your AI provider, cloud and Stripe usage for charges you don't recognize and report them through the form in Railway's incident report.
3. Reconnect GitHub and recreate Railway CLI and CI tokens, since existing API tokens and sessions were invalidated.
4. Review logs of connected databases and services for access from unknown addresses since October 18.

More data breaches in the United States →

Check the other services you use →