{"type":"bundle","id":"bundle--d6bae15f-62ef-5c3f-9065-36c32053da33","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--8096b701-91f5-5dd3-b57b-46b4b524ae34","created":"2026-10-22T11:57:21.806Z","modified":"2026-10-22T11:57:21.806Z","name":"Railway breach exposed customer environment variables: rotate every secret stored in Railway","description":"On 2026-10-21 Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables and, for some of them, obtained the decrypted contents. Environment variables on Railway commonly hold API keys, database passwords, registry credentials and wallet private keys. Railway says impact may be limited to a subset of users but recommends every user roll all environment variables, API keys and private registry credentials stored in Railway and review service logs. Railway believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it notified those providers to revoke keys. Railway paused builds, rotated S3 credentials for every storage bucket, invalidated GitHub tokens it held, invalidated OAuth sessions and all Railway API tokens, and published per-provider recovery guides. Researcher Taylor Monahan reported that wallet private keys stored in Railway were swept by address 0xd9773325282874d18cb83f1fe50f14c39750b2ee (about $371,000, 500+ transactions, 19+ EVM chains), with the first theft at 19:36 UTC on 2026-10-21, before Railway's 21:59 UTC notice. No CVE applies.","aliases":["Railway breach","Railway security incident October 2026","Railway environment variables leak","Railway env vars decrypted","Railway security disclosure October 21 2026","status.railway.com QH8L8B3E"],"first_seen":"2026-10-21T19:36:00Z","last_seen":"2026-10-22T11:01:00Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Railway: Security Disclosure, Wednesday October 21st","url":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st"},{"source_name":"Railway status incident QH8L8B3E: platform outage and security notice updates","url":"https://status.railway.com/incident/QH8L8B3E"},{"source_name":"Railway: Redeploy buckets and reconnect GitHub after the credential reset","url":"https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset"},{"source_name":"Railway: Rotate PostgreSQL database credentials","url":"https://blog.railway.com/p/security-disclosure-recommendation-rotate-postgresql-database-credentials"},{"source_name":"Railway: Check for unexpected OpenRouter usage","url":"https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openrouter-usage"},{"source_name":"Railway: Check for anomalous AWS access","url":"https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access"},{"source_name":"Taylor Monahan (@tayvano_) on wallet keys drained from Railway","url":"https://x.com/tayvano_/status/2113056813646238196"},{"source_name":"The Hacker News: Railway says intruder may have accessed customer environment variables","url":"https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html"},{"source_name":"HOL blog: Railway breach operator write-up","url":"https://hol.org/blog/railway-breach-environment-variables-rotate-secrets"}]}]}