Railway Urges Users to Rotate Credentials After Security Incident.

Railway is asking customers to replace credentials stored on its cloud deployment platform after an intrusion may have exposed customer environment variables, with some values already decrypted, putting API keys and database passwords at risk.

Its initial investigation found that an intruder may have accessed the service holding customer variables. The company has not disclosed how many accounts were affected or how access occurred, and said it would contact accounts confirmed to be affected.

Railway advised all users to rotate every key and password stored on the platform, although the potential exposure may involve only some customers. Developers commonly store service credentials in environment variables, which applications read at startup.

The incident disrupted deployment operations. Enterprise builds resumed at 11:32 p.m. ET Oct. 21 (03:32 UTC Oct. 22), while Pro, Hobby, Free and Trial plans were still awaiting restoration at midnight ET Oct. 22 (04:00 UTC). Redeploy remained unavailable in that update, with users directed to deploy the latest commit through a different control.

Railway said the breach was part of a recent series of attacks on deployment providers intended to reach AI inference service providers. None of the companies has confirmed whether the Railway, Zeabur and OpenCode incidents were carried out by the same attackers.