Railway halts deployments after suspected leak of decrypted env vars
Earlier this week Railway, a cloud hosting platform with roughly 4.8 million users and over 16 million services, detected suspicious activity on the systems that store customer environment variables.
What happened
The company stopped all new deployments while it investigates. Builds for Pro and Enterprise workspaces were restored on 22 Oct 2026 08:44 UTC, but Hobby, Free and Trial workspaces remain on hold.
Why it matters
If an attacker obtained decrypted environment variables, they could read API keys, database passwords, or other secrets embedded in applications. That would give them direct access to downstream services.
Who is affected
Railway says the incident could impact a subset of its user base. With 4.8 million accounts, even a small fraction represents a sizable attack surface.
Steps you should take now
- Rotate every secret stored in Railway—API tokens, database credentials, third‑party keys.
- Audit recent logs for unexpected access or deployment activity.
- Consider moving highly sensitive secrets to a dedicated secret‑management solution.
- Monitor for unusual outbound traffic from your services.
What Railway is doing
The provider will notify directly any user whose account is confirmed compromised. It continues to work on restoring deployments for the remaining tiers.
Keep an eye on Railway’s status page for the next update.