Railway
CriticalConfirmedDigital services
On 21 October 2026, the hosting platform Railway detected abnormal activity on the systems that store its customers' environment variables. An unauthorized third party may have accessed encrypted values and obtained some of them in plain text. The data potentially affected includes API keys, database passwords and private container registry credentials. Railway believes only a subset of customers is affected, but asks all users to rotate their secrets, and says it will email accounts directly once their exposure is confirmed. The number of affected accounts, the access method and whether encryption keys were compromised have not been disclosed.
Secrets of this kind can let a third party access the linked databases and services, or use paid APIs at the key holder's expense.
- Disclosed on
- October 21, 2026
- Incident dated
- October 21, 2026
- Sector
- Digital services
- Country
- International or undetermined
- Cause
- Undisclosed
Exposed data
- Customer ID
- Password (plaintext)
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- Railway : une cyberattaque menace les accès sensibles de ses clientsCyberattaque.org
- Railway Security Incident: Hackers May Have Accessed Customer Environment VariablesCyber Security News
- Railway tells all users to rotate secrets after breachStartupHub.ai
- Security Disclosure: Wednesday October 21stdaily.dev
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact