Railway Is Down and Says Secrets May Have Leaked. What to Do Now

Railway had a very bad day. Its dashboard, API and command line tool went down early on October 21, and builds stopped in every region. Then, at 21:59 UTC, it posted a security notice. It says an outsider may have read the secrets its customers store there.

Background: the checks every business site needs.

If you run anything on Railway, do not wait for builds to come back. Start changing keys at the source tonight.

What Railway Says Happened

Railway's security disclosure says it found unusual activity in the systems that hold customer environment variables. Those are the settings where apps keep API keys, database passwords and registry logins.

• An outsider may have read encrypted variables.
• For some of them, the outsider may also have the decrypted values.
• Railway thinks this is part of a series of attacks on platform companies, aimed at getting into AI providers.
• It has asked those providers to revoke keys on their side.
• Its first look says only some users were hit. It still tells every user to act.
• It will email the accounts it confirms were affected.

Railway has not said how many accounts that is, when the access began or who did it.

The Day in Order

Railway's status page logged about two dozen updates in under 20 hours. These are the ones that change what you can do.

Pacific time is seven hours behind UTC, so the security notice landed at 2:59 p.m. on the West Coast.

The Issues Still Open

This is where it gets messy. These are the problems people are stuck with tonight.

1. You cannot deploy. Builds are off on every plan. A bug fix, a new feature or a new key cannot ship until they come back.
2. New keys cannot reach a running app. Apps read their settings when they start. Change a key in Railway and the live service keeps the old one until a redeploy, which you cannot do yet.
3. Bucket keys were changed under you. Railway reset the access keys for every storage bucket. A service still holding the old ones may fail to read or write files until it redeploys.
4. GitHub links were cut. Railway says it cut the tokens behind your GitHub connection. You will have to reconnect it, and autodeploy may be off.
5. Old registry tokens still work. Railway removed GitHub tokens saved as registry logins, but they keep working on GitHub until you revoke them there.
6. Support was down too. The support and community site, station.railway.com, was listed as affected most of the day.
7. Everyone got logged out. Railway wiped login sessions at 20:19 UTC.
8. Scope is still unknown. No account count, no start time and no attacker named yet.

What to Rotate First

Railway's own advice is to roll every variable, every API key and every private registry login. It is a lot. Go in this order, the ones that cost money or open data first.

1. Payment keys. Stripe and any other card processor. Railway posted a guide just for Stripe.
2. AI provider keys. OpenAI, Anthropic, OpenRouter and Grok. Railway says AI providers were the real target. Check usage for spend you did not make.
3. Database passwords. Postgres, MySQL, MongoDB and Redis. Railway has a guide for each.
4. Cloud accounts. AWS and Google Cloud keys. Look for new users, new keys or servers you did not start.
5. GitHub. Revoke old tokens and check for deploy keys or webhooks you do not know.
6. Email, text and everything else. Any service that can send as your business or bill you.

Change each key at the provider first. Then save the new value in Railway so the next deploy picks it up. When builds come back, redeploy, then turn off the old key. Some providers, Authorize.net for one, let the old key live a while so you can switch without downtime.

Why You Cannot Just Wait

A stolen key does not need Railway to work. Someone with your OpenAI key can spend on your OpenAI account. Someone with your database password can reach your database if it is open to the internet. Railway being down does not slow them down.

So the fix happens at each provider, not inside Railway. That part you can do tonight, builds or no builds.

Railway's Guides

Railway posted 13 short guides by 02:19 UTC on October 22. They cover usage checks for OpenRouter, Grok, Anthropic, OpenAI and Stripe. They also cover password changes for Postgres, MongoDB, Redis and MySQL, access checks for GitHub, AWS and Google Cloud, and how to redeploy buckets and reconnect GitHub. All of them link from the status page.

We will update this story when builds come back or Railway says how many accounts were hit.

Before You Call

Is Railway down right now?

As of 03:00 UTC on October 22, 2026, Railway's status page still showed a major outage. The API came back that morning, but builds and deploys were paused in all four build regions. Check status.railway.com for the latest.

What happened in the Railway security incident?

Railway says it saw unusual activity in the systems that store customer environment variables on October 21, 2026. It believes an outsider may have read encrypted variables and, for some of them, the decrypted contents. Railway ties it to a wave of attacks on platform companies aimed at AI providers.

Do I need to rotate my Railway environment variables?

Yes. Railway tells every user to roll all environment variables, API keys and private registry credentials, even though it says only a subset of users may be affected. It will email accounts it confirms were hit.

Can I redeploy on Railway with new keys?

Not yet, as of 03:00 UTC on October 22. Builds are paused, so a running service keeps its old values until builds come back. You can still change keys at each provider now and put the new values in Railway, ready for the next deploy.

Why did Railway log me out?

Railway invalidated OAuth sessions at 20:19 UTC on October 21 as part of the fix. Anyone signed in had to log in again.