Railway pauses deployments after attacker accesses customer environment variables

Railway disclosed on 21 October 2026 that an unauthorised party accessed systems storing customer environment variables and obtained decrypted contents for a subset of users. Railway said the intrusion appeared to be part of a wider series of attacks against platform companies aimed at compromising AI inference providers, and that it notified upstream providers to revoke keys proactively. The company paused all deployments during its investigation and advised every user to rotate environment variables, API keys and private registry credentials immediately.