Railway says an unauthorized party may have accessed customer environment variables, which can hold API keys and database passwords. If you host an app on Railway, rotate the secrets stored there now, redeploy dependent services, and check for unusual use. Railway says its initial review suggests the impact may be limited to a subset of users. It has not said every customer’s secrets were exposed.

What happened?

Railway reported on October 21 that it detected unusual activity in systems storing customer environment variables. These are settings passed to an app at runtime. They often contain credentials for databases, registries, or outside services.

The company says its investigation so far indicates that a third party may have accessed encrypted variables and obtained the decrypted contents of some of them. It is contacting confirmed affected customers separately. While the scope is still under review, Railway recommends that all users rotate environment variables and private registry credentials as a precaution.

Railway paused builds during its response. Its incident page said, as of 03:00 UTC on October 23, that builds and deployments were proceeding normally across Enterprise, Pro, Hobby, Trial, and Free workspaces. New signups remained paused, and Railway was still sending notices to affected customers. Its preliminary report had not yet been published.

What should you do?

1. List what Railway stores. Review each project’s environment variables and private registry credentials. Identify database passwords and API keys that grant access outside Railway.
2. Replace secrets at their source. Revoke or rotate keys at the issuing service, then update their values in Railway. Do not assume changing a Railway variable invalidates an old key at its provider. Prioritize keys with access to production data or billing.
3. Redeploy every dependent app. Running containers may continue using an older value until redeployment. Railway’s PostgreSQL guide says regenerating a database password updates its template variables but does not redeploy other services that use it. Check manually copied connection strings and outside consumers too.
4. Restore Railway integrations. Railway says API and project tokens created before the incident were invalidated. Create new tokens if your automation uses its Public API or command-line client. Follow the status page for current service conditions.
5. Verify and investigate. Test app health, database connections, and deployments. Review the issuing services’ usage and audit logs for activity you do not recognize. Preserve evidence and contact the relevant provider and Railway support if you find signs of misuse.

For Railway-hosted PostgreSQL, use Railway’s database-specific procedure rather than changing only a variable by hand: the password inside the database and the connection settings must stay in sync. Other databases and external integrations have different rotation steps.

Reporting checked October 23, 2026, 04:18 UTC. Railway’s investigation and service status are changing; consult its disclosure and live incident page for later updates.