Railway breach exposed customer environment variables: rotate every secret stored in Railway
Direct answer
Railway breach exposed customer environment variables: rotate every secret stored in Railway, also tracked as Railway breach / Railway security incident October 2026 / Railway environment variables leak is a high-severity threat campaign HOL Guard tracked from Oct 21, 2026 to Oct 22, 2026, verified against 9 primary sources and last reviewed Oct 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
On 2026-10-21 Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables and, for some of them, obtained the decrypted contents. Environment variables on Railway commonly hold API keys, database passwords, registry credentials and wallet private keys. Railway says impact may be limited to a subset of users but recommends every user roll all environment variables, API keys and private registry credentials stored in Railway and review service logs. Railway believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it notified those providers to revoke keys. Railway paused builds, rotated S3 credentials for every storage bucket, invalidated GitHub tokens it held, invalidated OAuth sessions and all Railway API tokens, and published per-provider recovery guides. Researcher Taylor Monahan reported that wallet private keys stored in Railway were swept by address 0xd9773325282874d18cb83f1fe50f14c39750b2ee (about $371,000, 500+ transactions, 19+ EVM chains), with the first theft at 19:36 UTC on 2026-10-21, before Railway's 21:59 UTC notice. No CVE applies.
Also tracked as Railway breach · Railway security incident October 2026 · Railway environment variables leak · Railway env vars decrypted · Railway security disclosure October 21 2026 · status.railway.com QH8L8B3E
- First observed
- Oct 21, 2026
- Last observed
- Oct 22, 2026
- Last reviewed
- Oct 22, 2026
- Tracking ended
- Oct 22, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Railway has not published how many accounts were affected, when access began, or how the intruder reached the variable store. The wallet-drain figures come from one researcher's on-chain tracking and were not independently verified by HOL. Railway says it will email affected customers as it confirms them; absence of an email is not confirmation of non-exposure.
- Secrets that never lived in Railway variables are not exposed by this incident; a vault master token stored in a Railway variable is in scope
- Railway-issued bucket credentials and Railway API tokens were already invalidated by Railway; users still need to redeploy and create new tokens
- Railway has not said source code, volumes or database contents were accessed; a leaked database password on a publicly reachable database is a separate exposure to rule out
- This is not a CVE or a bug in customer applications; there is nothing to upgrade
- Railway's scope statement ('subset of users') is preliminary
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
Not covered, or partially covered
not covered
HOL Guard reviews AI coding agent actions on developer machines. It does not run inside Railway, cannot detect access to Railway's variable store, and cannot revoke leaked keys; the fix is rotation at each provider.
No campaign-specific policy guidance is published.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Update
Railway status incident opens; dashboard, API, CLI and builds degrade and builds are paused in all regions. Railway's disclosure says anomalous activity was detected that morning.
Sources:Railway status incident QH8L8B3E: platform outage and security notice updates·Railway: Security Disclosure, Wednesday October 21st
- First observed
First known theft from a wallet whose private key was stored in Railway, per on-chain tracking of address 0xd9773325282874d18cb83f1fe50f14c39750b2ee.
Sources:Taylor Monahan (@tayvano_) on wallet keys drained from Railway·The Hacker News: Railway says intruder may have accessed customer environment variables
- Disclosure
Railway posts its security notice: encrypted environment variables may have been accessed and some decrypted; all users told to roll variables, API keys and registry credentials.
Sources:Railway status incident QH8L8B3E: platform outage and security notice updates·Railway: Security Disclosure, Wednesday October 21st
- Vendor action
Railway begins rotating credentials for every storage bucket.
Sources:Railway status incident QH8L8B3E: platform outage and security notice updates·Railway: Redeploy buckets and reconnect GitHub after the credential reset
- Vendor action
Railway publishes per-provider recovery guides (OpenAI, Anthropic, Grok, OpenRouter, Stripe, AWS, GCP, GitHub, PostgreSQL, MySQL, MongoDB, Redis, buckets).
Source:Railway status incident QH8L8B3E: platform outage and security notice updates
- Vendor action
Builds restored for Enterprise workspaces so new credentials can be deployed.
Source:Railway status incident QH8L8B3E: platform outage and security notice updates
- Vendor action
Railway invalidates all Railway API tokens.
Source:Railway status incident QH8L8B3E: platform outage and security notice updates
- Vendor action
Builds restored for Pro workspaces; Hobby, Free and Trial still pending as of 11:01 UTC.
Source:Railway status incident QH8L8B3E: platform outage and security notice updates
- Update
HOL publishes the operator write-up with rotation order and provider-side checks.
Publication clock: 14.0 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
Railway service, shared and environment variables (customer secrets)railwayconfigRailway storage bucket ACCESS_KEY_ID / SECRET_ACCESS_KEY (reset by Railway)railwayremote dependencyRailway Public API tokens (invalidated by Railway)railwayremote dependency
Sources
Every claim on this record is traceable to the sources below.
- Railway: Security Disclosure, Wednesday October 21stvendor advisory · observed October 21, 2026
- Railway status incident QH8L8B3E: platform outage and security notice updatesvendor advisory · observed October 22, 2026
- Railway: Redeploy buckets and reconnect GitHub after the credential resetvendor advisory · observed October 22, 2026
- Railway: Rotate PostgreSQL database credentialsvendor advisory · observed October 22, 2026
- Railway: Check for unexpected OpenRouter usagevendor advisory · observed October 22, 2026
- Railway: Check for anomalous AWS accessvendor advisory · observed October 22, 2026
- Taylor Monahan (@tayvano_) on wallet keys drained from Railwayresearch · observed October 21, 2026
- The Hacker News: Railway says intruder may have accessed customer environment variablesresearch · observed October 22, 2026
- HOL blog: Railway breach operator write-upother primary · observed October 22, 2026
Related reviewed records
Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.
Campaign questions, answered
On 2026-10-21 Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables and, for some of them, obtained the decrypted contents. Environment variables on Railway commonly hold API keys, database passwords, registry credentials and wallet private keys. HOL Guard tracked the campaign from Oct 21, 2026 to Oct 22, 2026.
No. Active tracking ended Oct 22, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 9 primary sources, names 3 reviewed artifacts, and was last fully reviewed Oct 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Railway has not published how many accounts were affected, when access began, or how the intruder reached the variable store. The wallet-drain figures come from one researcher's on-chain tracking and were not independently verified by HOL.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-2A02F7F8