Railway updates incident response information: users still need to revoke and replace sensitive credentials

Railway confirmed unauthorised access to some internal systems, potentially affecting sensitive data stored in environment variables. Core build and deployment services have been restored. Customers should still follow official guidance to revoke old keys, rotate credentials and check for unusual activity.

Source Facts

Railway's official 21 October notice says a third party may have obtained encrypted environment variables and decrypted some of them. These variables can hold API keys and credentials for databases and private package repositories, so signing back into the website alone is insufficient.

The company subsequently published a preliminary report, saying it had revoked credentials, rebuilt systems and engaged external incident investigators. The investigation remains ongoing. Precautionary revocation covered a wider group of users; receiving a key-revocation notice does not mean every key was confirmed to have been accessed.

At 22:06 UTC on 23 October (06:06 on 24 October in Hong Kong), the official status page said core builds, deployments, APIs and the console had returned to normal. It still required customers to rotate sensitive data, revoke old credentials and redeploy dependent services.