Breaches · 7h ago
Railway said Wednesday that an intruder may have accessed decrypted environment variables for a subset of customers; the company did not give a count. Researcher Taylor Monahan reported cryptocurrency wallets with private keys stored on Railway were drained, with the first known theft transaction at 7:36 p.m., at least two hours before Railway disclosed the incident.
Environment variables can hold the keys an application uses to log in to databases, APIs, registries, or wallets. If copied in decrypted form, those keys can be used directly against the connected service. Railway has invalidated its own API tokens and bucket credentials, but that cannot invalidate copied keys for other services.
For teams storing secrets on Railway, the exposure follows each secret to the service it unlocks, not just to the hosting account. Railway has restored builds for Pro and Enterprise workspaces, while some lower-tier builds remain disrupted; downstream access may persist even as the platform recovers.
2 sources covering this story
Developer platform Railway urges 'all users' to revoke secret keys after cyberattack | TechCrunch
The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway says an intruder may have accessed decrypted environment variables for some users, as a researcher reports related cryptocurrency theft.
Part of the PlainSec briefing for 2026-10-22