Railway paused every deployment. Your environment variables may have been read.

On 22 October 2026 Railway said an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It paused all deployments, told customers to rotate every secret and check logs, and said it will contact accounts confirmed as compromised. Railway has not said how many users are affected.

Environment variables are where the database password and the payment key live. If your app runs on Railway, the next deploy is on hold and the keys it uses may already be in someone else's hands.

Rotate every secret stored on Railway today, including database passwords, API keys and private registry credentials. Then read your service logs for use of those keys you do not recognize.