Railway Tells Every User to Rotate Their Keys After Hackers May Have Decrypted Customer Secrets

Railway has told every one of its customers to throw away every secret they ever stored on the platform. API keys, database passwords, private registry credentials: all of it should be rolled, now.

The reason is in the company's security disclosure from Wednesday. Railway detected "anomalous activity involving systems that store customer environment variables," and an unauthorized third party may have accessed those encrypted variables and, for some of them, obtained the decrypted contents. Railway says the impact may be limited to a subset of users, but it is asking everyone to act.

Railway says 2 million builders and tens of thousands of companies use it, its own figure from January. That makes this a key rotation fire drill on a very large scale.

Aimed at AI inference

The most striking line in the disclosure is about motive. "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," Railway wrote. It says it notified those upstream providers so they could revoke keys proactively.

That fits a pattern from the same week. OpenCode said hackers took more than 1% of its customers' API keys and other secrets in a similar attack, and we covered how intruders at OpenCode ran up charges on linked OpenAI, Anthropic and Google keys. A developer platform full of stored keys is a shortcut into a lot of other accounts.

Railway published guides on checking for unexpected usage at OpenAI, Anthropic, Grok, OpenRouter and Stripe, spotting anomalous access to AWS, Google Cloud and GitHub, and rotating Postgres, MySQL, MongoDB and Redis credentials.

Locked out while trying to fix it

The response was blunt. According to Railway's status page, trouble began on the morning of October 21 UTC, with the dashboard, API and CLI unavailable, builds paused in every region and the support site down.

Railway then signed users out by invalidating OAuth sessions, rotated all storage bucket credentials, and invalidated all Railway API tokens and project tokens. Customers saw a Railway engineer's name on the bucket resets in their audit logs. The company also reset the GitHub tokens it held, so users have to reconnect GitHub themselves.

The catch was obvious to anyone trying to follow the advice. With builds frozen, customers could not redeploy their apps with fresh credentials, so rotated keys could not actually go live for many hours.

Builds came back in stages. Enterprise customers got them first, early on October 22 UTC, then Pro, then Hobby on the evening of October 22. At the last status update, at 21:59 UTC on Thursday, Free and Trial users were still waiting and new signups were temporarily paused.

What Railway has not said

Plenty is still unknown. Railway has not said how many users were affected, what the root cause was or who is behind the attack. TechCrunch reports that the company did not answer questions about whether the hackers had contacted it, such as with a ransom demand.

Founder and CEO Jake Cooper told TechCrunch that Railway plans to publish a post-mortem. Until then, customers are left checking their bills and logs across every service whose keys ever passed through the platform.

Some offers on this page may be paid placements or contain affiliate links.