Railway published a security disclosure on Oct 21 saying it detected anomalous activity that morning in systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents, which can include API keys and database and registry credentials.

• Scope: Railway says impact may be limited to a subset of users but recommends every user act as a precaution, and will email affected customers as it confirms them.
• Attribution (Railway's view): it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it has notified those upstream providers to revoke keys proactively. Compare the Zeabur and PingCAP incidents this week.
• Platform state (status page, last update 22:45 UTC): builds and deployments are paused for all tiers including Enterprise, OAuth sessions were invalidated, and Railway is revoking and rotating all storage bucket credentials. Customers will see those revocations in audit logs under a Railway employee's name, which Railway says is expected.

Developers on Hacker News and X report their Railway-stored keys being used by third parties. That's anecdotal and Railway hasn't confirmed numbers.

Do now: rotate every secret stored in Railway at the issuing provider, then review provider and service logs for use since Oct 21. Because you can't redeploy yet, revoking a key will break that service until builds return, so prioritize payment, cloud and AI-provider keys. See the tip.