Cloud provider Railway says an unauthorized party may have accessed customers' encrypted environment variables and, for some, obtained the decrypted contents
Earlier this morning, Railway detected anomalous activity involving systems that store customer environment variables.
Railway BlogJacob Cooper
Context & Ripple Effects
Railway’s May 2026 outage, which it attributed to a Google Cloud account suspension, had already made its upstream dependency visible to customers through a cloud-account suspension outage. The new disclosure moves the operational risk closer to customers’ own application credentials: encryption at rest does not contain an incident if an intruder can reach decrypted values.
The incident also fits a credential-exposure pattern seen in the alleged Snowflake customer-credential listings reported in 2024, where access to cloud environments can become the consequential asset rather than the provider’s infrastructure itself.
First-order effects
Railway customers whose environment variables may have been accessed must rotate affected secrets and review systems that relied on those values, because some decrypted contents may have been obtained.
Railway must contain the anomalous activity and restore confidence in the systems used to store and decrypt customer configuration secrets.
Second-order effects
Customers’ downstream services and integrations face operational churn as replaced credentials must be propagated through deployments, databases, and external service configurations.
Competing deployment platforms are pressured to explain how they isolate secret storage, decryption access, and incident response for customers evaluating provider risk.
Third-order effects
The incident reinforces that secret-management controls are a trust boundary for cloud platforms, not merely a storage feature: encryption offers limited protection when access to decryption paths is compromised.
If similar disclosures persist, buyers are likely to weigh cloud providers’ credential-isolation and recovery processes alongside uptime, pushing security architecture into platform selection.
The trend: Cloud-platform trust is increasingly determined by control of customer credentials and decryption paths, not only by infrastructure availability.
holy fucking shit, railway too??? an attacker have accessed customer environment variables, including decrypted api keys and database credentials. deployments have been paused and users are being told to rotate their secrets. what an absolute nightmare for developers.
It took Railway almost 15 hours to notify its thousands of customers that their environmental variables have been compromised. Several people on this app raised alarm about their keys being drained and/or receiving “your key has been compromised” emails Super irresponsible [image…
We are currently shutting down Postiz for all customers. We are afraid @Railway has been compromised; they won't tell us. We have received emails from Anthropic and Stripe that our keys have been compromised. We are digging into it and will get back to you ASAP!
If you're a Railway user acting on today's security incident, here are some best next steps: > Rotate any potentially exposed secrets and credentials > Review audit logs for suspicious access > Set up automated rotation for DB credentials and API keys > Use short-lived, dynamic c…
Railway is compromised, rotate all API keys as soon as possible Deployments are down so don't wait to redeploy Attackers are draining keys in real time, we didn't lose much but can confirm this is still an active attack Stay safe friends
Today, we were alerted of malicious activity that compromised Railway's servers We are sharing this with you broadly and swiftly. We recommend folks rotate their keys out of an abundance of caution.
If you're a railway customer, you need to jump on this immediately. — “We strongly recommend that you immediately roll all environment variables, including any API keys, stored in Railway” — blog.railway.com/p/security- d...
When it rains it pours: https://blog.railway.com/... > an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents
Railway has been turbo pwned, I'm freaking out because hackers have access to decrypted ENV variables and I asked Claude to help but- NOPE. NOT CLAUDE. The most dangerous part of this ecosystem is @anthropic and their ridiculous moralizing.
What's lost in this message is that you can't actually rotate your keys because deployments are halted. They are really just asking customers to take their apps offline indefinitely, even if unaffected. Just say that. This is 🤯 bad. FML I'm pouring myself a vodka.
wow. this might be the end of railway. attackers stole env vars of deployments. entire infra compromised. but the kicker is that deploys are disabled. so you cannot actually deploy with new env vars. meaning projects currently hosted on railway are either compromised or down
If you're a Railway customer who can't deploy your rotated secrets right now, we'll host your app free on @synteq while the Railway team works to restore deployments. Security has been a nightmare this week. We're wishing the Railway team the best through this recovery & are happ…
this company is dead they waited half a day to notify customers of their secrets breach disable new deployments, while telling people to rotate secrets (so requiring them to deploy elsewhere)
just got royally fucked by this so you're telling me i pay railway every month to keep my secrets safe, and now i have to rotate every single one of them myself except all deployments are paused, so if i rotate now my app breaks, and if i don't, someone else might have my keys fm…
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials. Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner. Railway said a subset of…
Spent multiple hours now evaluating Railway alternatives to move my shit to. Conclusion is that Railway's product is uniquely good and nothing comes close to a drop in replacement 🙃 Minimum cost to replicate my setup today is 3x higher than I am paying them currently