Railway halted all deployments Wednesday after discovering that an unauthorized party may have accessed customer environment variables, and the cloud platform has instructed all users to rotate their stored secrets immediately.

In a security disclosure posted October 21, Railway said it detected "anomalous activity" Wednesday morning in systems that store customer environment variables. Those variables hold the settings and secrets an application needs in order to run, typically API keys along with database and registry credentials. That concentration is what makes them a high-value target: a single store can hold live credentials to many external services at once.

The company hedged on the scope of the incident. According to the disclosure, the intruder "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Initial analysis indicated that a limited subset of users may be affected, but the review is ongoing, and Railway has told everyone to act as though their secrets have been exposed.

The platform's scale gives the warning weight. In January, Railway announced that 2 million builders and tens of thousands of companies use the platform, ranging from small shops to Fortune 500 firms.

Deployments paused across all plans

Deployments are on hold for every customer, including Enterprise accounts. Railway apologized for the disruption and said customers will be unable to deploy new versions of their applications until builds are reinstated.

The company had earlier sketched a staged restart, with Enterprise workspaces coming back online first, followed by Pro, Hobby, Free, and Trial plans.

Railway tells users to check OpenAI, Anthropic and Stripe usage

Railway wants users to immediately roll every environment variable on the platform, such as API keys and private registry credentials, and then comb through service logs for anything unusual. Rotation is the step that defuses the risk: replacing a credential invalidates its old value, so any copy taken before the change stops working. Affected accounts will receive a direct email once Railway confirms them.

The company is also rotating all of its storage bucket credentials, with the new credentials surfacing automatically in user dashboards. As part of its mitigation, Railway invalidated OAuth sessions, signing some users out. The outage also disrupted the platform's API, dashboard, and support site at station.railway.com.

On October 22, Railway released guides encouraging users to monitor their systems for unusual access attempts against Google Cloud and Amazon Web Services. Additional guides cover abnormal usage of OpenAI, Anthropic, Grok, OpenRouter, and Stripe, reflecting concern that leaked keys could extend beyond Railway's environment.

In the Google Cloud guide, users are advised to invalidate any exposed service account key and review Cloud Audit Logs for unauthorized actions.

Part of a wider campaign on AI providers

Railway's notification describes the breach as "part of a series of attacks recently targeting platform companies with the goal of compromising AI inference providers." According to the company, it urged all of its upstream providers to invalidate all keys. AI inference providers run AI models on behalf of other organizations.

The incident follows other recent security failures in the sector. Cryptopolitan previously reported that 8 people disclosed 17,286 DOT as having been transferred through unauthorized access, and that the Fearless Wallet browser extension had sent Polkadot users' private keys to an attacker's server.

Security experts have reported that inexpensive AI tools now enable intrusions that previously could be accomplished only with state-level resources. One intruder spent approximately $50 per attack.

Railway's status page is tracking the incident, and users can watch it for updates on when deployments resume.