Railway says attackers may have accessed some decrypted customer environment variables, pauses deployments during investigation

Railway detected anomalous activity on Oct. 21, 2026 involving systems that store customer environment variables, saying an unauthorized third party may have accessed encrypted variables and decrypted contents for some of them. The company recommends all users immediately rotate API keys, environment variables, and private registry credentials, and says deployments are paused until builds are restored.

For teams running production apps on Railway, the immediate decision is whether to rotate all stored secrets now despite deployment disruption; Railway is recommending that precaution because the affected subset is not yet confirmed. The trade-off is operational churn versus reducing exposure if decrypted secrets were obtained, and the key limitation is that Railway has not yet disclosed which accounts or variables were affected.