{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-2A02F7F8",
  "slug": "railway-breach-environment-variables-rotate-secrets",
  "title": "Railway breach exposed customer environment variables: rotate every secret stored in Railway",
  "aliases": [
    "Railway breach",
    "Railway security incident October 2026",
    "Railway environment variables leak",
    "Railway env vars decrypted",
    "Railway security disclosure October 21 2026",
    "status.railway.com QH8L8B3E"
  ],
  "summary": "On 2026-10-21 Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables and, for some of them, obtained the decrypted contents. Environment variables on Railway commonly hold API keys, database passwords, registry credentials and wallet private keys. Railway says impact may be limited to a subset of users but recommends every user roll all environment variables, API keys and private registry credentials stored in Railway and review service logs. Railway believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it notified those providers to revoke keys. Railway paused builds, rotated S3 credentials for every storage bucket, invalidated GitHub tokens it held, invalidated OAuth sessions and all Railway API tokens, and published per-provider recovery guides. Researcher Taylor Monahan reported that wallet private keys stored in Railway were swept by address 0xd9773325282874d18cb83f1fe50f14c39750b2ee (about $371,000, 500+ transactions, 19+ EVM chains), with the first theft at 19:36 UTC on 2026-10-21, before Railway's 21:59 UTC notice. No CVE applies.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Railway has not published how many accounts were affected, when access began, or how the intruder reached the variable store. The wallet-drain figures come from one researcher's on-chain tracking and were not independently verified by HOL. Railway says it will email affected customers as it confirms them; absence of an email is not confirmation of non-exposure.",
  "firstObservedAt": "2026-10-21T19:36:00Z",
  "lastObservedAt": "2026-10-22T11:01:00Z",
  "publishedAt": "2026-10-22T11:57:21.806Z",
  "reviewedAt": "2026-10-22T11:57:13.494Z",
  "expiresAt": "2026-10-22T11:01:00Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "railway-disclosure",
      "label": "Railway: Security Disclosure, Wednesday October 21st",
      "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-21T21:59:00Z"
    },
    {
      "id": "railway-status",
      "label": "Railway status incident QH8L8B3E: platform outage and security notice updates",
      "url": "https://status.railway.com/incident/QH8L8B3E",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-22T11:01:00Z"
    },
    {
      "id": "railway-guide-buckets-github",
      "label": "Railway: Redeploy buckets and reconnect GitHub after the credential reset",
      "url": "https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-22T01:22:00Z"
    },
    {
      "id": "railway-guide-postgres",
      "label": "Railway: Rotate PostgreSQL database credentials",
      "url": "https://blog.railway.com/p/security-disclosure-recommendation-rotate-postgresql-database-credentials",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-22T01:22:00Z"
    },
    {
      "id": "railway-guide-openrouter",
      "label": "Railway: Check for unexpected OpenRouter usage",
      "url": "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openrouter-usage",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-22T01:22:00Z"
    },
    {
      "id": "railway-guide-aws",
      "label": "Railway: Check for anomalous AWS access",
      "url": "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-22T01:22:00Z"
    },
    {
      "id": "monahan-wallet-drain",
      "label": "Taylor Monahan (@tayvano_) on wallet keys drained from Railway",
      "url": "https://x.com/tayvano_/status/2113056813646238196",
      "sourceType": "research",
      "observedAt": "2026-10-21T23:56:17Z"
    },
    {
      "id": "thn-railway",
      "label": "The Hacker News: Railway says intruder may have accessed customer environment variables",
      "url": "https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html",
      "sourceType": "research",
      "observedAt": "2026-10-22T11:26:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: Railway breach operator write-up",
      "url": "https://hol.org/blog/railway-breach-environment-variables-rotate-secrets",
      "sourceType": "other_primary",
      "observedAt": "2026-10-22T11:50:15Z"
    }
  ],
  "artifacts": [
    {
      "id": "railway-service-variables",
      "artifactClass": "config",
      "ecosystem": "railway",
      "name": "Railway service, shared and environment variables (customer secrets)",
      "version": null,
      "defanged": false
    },
    {
      "id": "railway-bucket-credentials",
      "artifactClass": "remote_dependency",
      "ecosystem": "railway",
      "name": "Railway storage bucket ACCESS_KEY_ID / SECRET_ACCESS_KEY (reset by Railway)",
      "version": null,
      "defanged": false
    },
    {
      "id": "railway-api-tokens",
      "artifactClass": "remote_dependency",
      "ecosystem": "railway",
      "name": "Railway Public API tokens (invalidated by Railway)",
      "version": null,
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "railway-status-outage-opens",
      "occurredAt": "2026-10-21T07:24:00Z",
      "eventType": "other",
      "summary": "Railway status incident opens; dashboard, API, CLI and builds degrade and builds are paused in all regions. Railway's disclosure says anomalous activity was detected that morning.",
      "sourceIds": [
        "railway-status",
        "railway-disclosure"
      ]
    },
    {
      "id": "wallet-drain-first-theft",
      "occurredAt": "2026-10-21T19:36:00Z",
      "eventType": "first_observed",
      "summary": "First known theft from a wallet whose private key was stored in Railway, per on-chain tracking of address 0xd9773325282874d18cb83f1fe50f14c39750b2ee.",
      "sourceIds": [
        "monahan-wallet-drain",
        "thn-railway"
      ]
    },
    {
      "id": "railway-security-notice",
      "occurredAt": "2026-10-21T21:59:00Z",
      "eventType": "disclosure",
      "summary": "Railway posts its security notice: encrypted environment variables may have been accessed and some decrypted; all users told to roll variables, API keys and registry credentials.",
      "sourceIds": [
        "railway-status",
        "railway-disclosure"
      ]
    },
    {
      "id": "bucket-credential-rotation",
      "occurredAt": "2026-10-21T22:10:00Z",
      "eventType": "vendor_action",
      "summary": "Railway begins rotating credentials for every storage bucket.",
      "sourceIds": [
        "railway-status",
        "railway-guide-buckets-github"
      ]
    },
    {
      "id": "recovery-guides-published",
      "occurredAt": "2026-10-22T01:22:00Z",
      "eventType": "vendor_action",
      "summary": "Railway publishes per-provider recovery guides (OpenAI, Anthropic, Grok, OpenRouter, Stripe, AWS, GCP, GitHub, PostgreSQL, MySQL, MongoDB, Redis, buckets).",
      "sourceIds": [
        "railway-status"
      ]
    },
    {
      "id": "enterprise-builds-restored",
      "occurredAt": "2026-10-22T03:32:00Z",
      "eventType": "vendor_action",
      "summary": "Builds restored for Enterprise workspaces so new credentials can be deployed.",
      "sourceIds": [
        "railway-status"
      ]
    },
    {
      "id": "railway-api-tokens-invalidated",
      "occurredAt": "2026-10-22T04:17:00Z",
      "eventType": "vendor_action",
      "summary": "Railway invalidates all Railway API tokens.",
      "sourceIds": [
        "railway-status"
      ]
    },
    {
      "id": "pro-builds-restored",
      "occurredAt": "2026-10-22T06:29:00Z",
      "eventType": "vendor_action",
      "summary": "Builds restored for Pro workspaces; Hobby, Free and Trial still pending as of 11:01 UTC.",
      "sourceIds": [
        "railway-status"
      ]
    },
    {
      "id": "hol-operator-writeup",
      "occurredAt": "2026-10-22T11:50:15Z",
      "eventType": "other",
      "summary": "HOL publishes the operator write-up with rotation order and provider-side checks.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-platform",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not run inside Railway, cannot detect access to Railway's variable store, and cannot revoke leaked keys; the fix is rotation at each provider."
    }
  ],
  "policies": [],
  "limitations": [
    "Secrets that never lived in Railway variables are not exposed by this incident; a vault master token stored in a Railway variable is in scope",
    "Railway-issued bucket credentials and Railway API tokens were already invalidated by Railway; users still need to redeploy and create new tokens",
    "Railway has not said source code, volumes or database contents were accessed; a leaked database password on a publicly reachable database is a separate exposure to rule out",
    "This is not a CVE or a bug in customer applications; there is nothing to upgrade",
    "Railway's scope statement ('subset of users') is preliminary"
  ],
  "correctionHref": "/guard/security/campaigns/railway-breach-environment-variables-rotate-secrets/corrections"
}