criticalHostingactive21 Oct 2026
Railway
Customer secret keys stolen from a hosting platform
What happened
Attackers reached Railway's internal secret store and exfiltrated customer credentials. Any project that trusted Railway-held secrets should assume those values are public.
Timeline
21 Oct 2026 · 18:20 UTC
Incident confirmed
Railway confirms unauthorised access to its secret store.21 Oct 2026 · 21:00 UTC
Key rotation
Platform tokens are invalidated; customer-held secrets are not.22 Oct 2026 · 10:45 UTC
Customer notice
Affected projects are told to rotate every injected variable.
Sources