Railway explains its breach and the latest API key revocations

Railway has published a preliminary account of the security incident disclosed on October 21, describing unauthorized access to internal systems and the decryption of some customer environment variables.

The company estimates that some variables in up to 1.85% of workspaces may have been compromised. Its investigation is ongoing, and it has not ruled out access to customer source code.

Running applications stayed online

Railway says existing customer deployments continued running while it paused builds and deployments during containment. The disruption also affected its dashboard, API, CLI, and support tools.

According to the report, the attacker’s access was fully removed by October 22 at 03:32 UTC. Railway says it rebuilt affected infrastructure, rotated credentials, and engaged external incident-response specialists.

Why replacement keys were revoked

In an October 24 update, Railway said subsequent API key revocations were precautionary, rather than evidence of another attack.

A batch supplied to OpenAI and Anthropic inadvertently included newer keys because Railway could not filter them by creation date. Providers may consequently have revoked replacements created after the incident.

What customers should do

Railway recommends rotating sensitive credentials stored on the platform before October 21 and reviewing relevant access logs.

For customers who have already completed those rotations, the latest notice does not require repeating them if their keys still work. If a provider revoked a replacement key, Railway says to create another, update the corresponding environment variable, and redeploy the services using it.