Railway Breach May Have Exposed Environment Variables: Rotate Keys Now

Every Railway customer got the same instruction on October 21: rotate every secret you store as an environment variable. The Railway breach, as the app-hosting platform describes it, may have let an intruder read those values, and for some of them, see the decrypted contents. Railway ties the incident to a wider campaign against AI model providers, which makes the warning especially pointed for developers who keep OpenAI or Anthropic keys in their project settings.

What Railway disclosed about the breach

Railway said it detected anomalous activity on the morning of October 21 involving the systems that store customer environment variables. Its investigation found that an unauthorized party may have accessed encrypted values and obtained the decrypted contents of some of them. In a statement quoted by BleepingComputer, the company said an unauthorized third party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents."

The Hacker News reported that Railway acted after learning of the access at 9:25 a.m. UTC on October 21. Railway paused builds and deployments and said it had notified upstream AI providers so they could revoke keys early. It named GitHub, GitLab, Anthropic, OpenAI, OpenRouter and Stripe among the partners in that revocation effort.

According to Brandefense, Railway also invalidated OAuth sessions on October 21, rotated all storage bucket credentials, reset the GitHub tokens it held and invalidated API and project tokens created before the incident. TechCrunch reported that the company urged all users to revoke their secret keys. Railway said the impact may be limited to a subset of users, but it has not published an affected-account count. It says it will email affected customers directly.

Which secrets were exposed in the Railway breach

Railway describes itself as a platform for deploying apps, and it stores deployment settings and credentials as environment variables. Coverage from BleepingComputer and The Hacker News says those variables can hold API keys, database credentials and private registry credentials. One project can therefore hold an AI key, a database password and a registry token side by side, so a single breach can reach several services at once.

The damage differs by secret type. A stolen database password exposes stored data. A stolen AI key can run up charges on someone else's account, and OpenCode victims learned about trouble that way. Railway has not confirmed misuse of any stolen key.

Timeline of the Railway breach and related incidents

The dates below come from Railway's disclosure and related reporting. The Zeabur figure comes from a secondary write-up and has not been checked against a primary source.

Deployments were still slow to start after builds came back, according to Instapods.

Why Railway links the attack to AI model providers

Railway's explanation is the most consequential claim in the disclosure. In a company statement quoted by The Hacker News, Railway said: "Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks." In this context, distillation means harvesting a model's outputs at scale to train a competing system.

The framing lines up with a U.S. government warning issued weeks earlier. On September 8, CISA, the NSA and the FBI said six China-based firms were running industrial-scale distillation campaigns against U.S. frontier models. The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies advised AI companies to monitor usage patterns, and CISA Acting Director Nick Andersen said of the advisory: "We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns..."

The volume involved is large. In an account from September, Anthropic put China-based distillation at roughly 190 million exchanges pulled from Claude, according to a summary by Cyera.

Read Railway's claim with care. The distillation attribution is the company's framing, not a verified finding. Railway has not named the attacker, and the sources available so far do not establish that distillation was the motive.

The OpenCode breach follows the same path

OpenCode said on October 17 that a legacy console system had been breached and that the incident affected 1.4% of OpenCode Console users. According to CPO Magazine, OpenCode described it as a large-scale distillation attack. The Hacker News reports that OpenCode has not explained how the breach connects to distillation or who was responsible.

SecureWorld describes the mechanics. The attacker went through a retiring legacy system that still held stored provider keys, and some users reported unexpected charges. That is the pattern Railway's disclosure points to: a platform breach reaches stored AI keys, and those keys get spent on someone else's bill.

The risk is not confined to one company. USA 24 has covered a LiteLLM master key leak that enabled a malicious 1.107.0 release on PyPI and a ConnectWise cloud backup breach that gave attackers global admin rights. Red Team Partners reported that Zeabur lost more than 3.2 million environment variable records and is shutting down by December 31, 2026, though that figure still needs confirmation.

What to rotate first and how to do it safely

Railway told all users to rotate every secret stored as an environment variable and to check connected service logs for unusual activity. Work through the list in this order:

• Inventory every project and environment, including staging projects and older ones that still deploy.
• Rotate AI keys first, including OpenAI, Anthropic, Google and OpenRouter keys. Then rotate cloud, payment and database credentials.
• Create the new key, update the variable and deploy, then revoke the old key. Rotation can break running apps if a key is revoked before its replacement is live.
• Review each provider's usage and audit logs for activity you did not cause. Go back further than October 21, because the start of the access is unknown.
• Check connected service logs for unusual activity, as Railway advised.
• Set spending limits and alerts on AI accounts, since unexplained charges were how OpenCode victims first noticed trouble.
• If you used OpenCode Console and linked external providers, revoke those keys with each provider.
• Treat any email about the breach with caution. Railway says it will email affected customers directly, so sign in to the dashboard yourself instead of following links in messages.

Allow extra time for deployments. Railway restored builds for Enterprise and Pro plans first, and deployments were still slow to start in the reporting.

What remains unknown about the Railway breach

This story is still developing, and several basic questions have no public answer yet.

• The attacker: Railway has not named the intruder, and no source reviewed names one.
• Entry point and start date: How the intruder got in and when access began are unknown.
• Scope: Railway has not said how many customers were affected.
• Misuse: Railway has not confirmed that any stolen key was used. OpenCode has not confirmed that specific keys were copied.
• Revocations: The sources reviewed do not confirm whether upstream providers finished revoking keys.
• Conflicting details: AI TL;DR says API tokens were invalidated on October 22, while Brandefense places the OAuth invalidation on October 21. Some write-ups say Railway did not identify the AI providers it notified, but The Hacker News reports that it named OpenAI and Anthropic among its partners.
• Location: USA 24 has not confirmed where Railway is headquartered or what share of its customers are in the United States, so this story does not treat Railway as a U.S. company.

What to watch next

Three signals will show how large this incident is. The first is whether Railway publishes an affected-account count and a fuller timeline. The second is whether the company names the attacker or produces evidence for its distillation claim. The third is whether OpenCode explains how its legacy-system breach connects to the same campaign.

For developers, the immediate task is more concrete. List every secret stored on Railway, rotate the AI keys first and watch the bills closely. A few hours of rotation costs far less than a drained API account, and the next platform incident may arrive with less warning than this one did.