Railway security incident October 21, 2026 (environment variables accessed and some decrypted): what do I need to rotate and check?

What happened: On October 21, 2026 Railway detected unauthorized access to the systems that store customer environment variables. Railway says the attacker may have accessed encrypted variables and, for some of them, obtained the decrypted values. Railway paused deployments while it responded. Its first analysis suggested only a subset of users was affected, but it asks ALL customers to take precautions and is emailing confirmed-affected accounts directly. Am I affected? Assume yes if you had any secret in a Railway service or shared variable: LLM/AI provider API keys, database URLs and passwords, payment, email and webhook keys, cloud credentials, private registry credentials, signing or session secrets. What to do (in this order): 1. List every variable in every Railway project and environment (including shared variables and preview environments). 2. Rotate each secret AT ITS SOURCE: create a new key at the provider (OpenAI/Anthropic/Stripe/AWS/your database), put the new value in Railway, redeploy, then revoke the old key. Changing the value only in Railway does nothing if the old key still works. 3. Rotate private registry credentials used for image pulls. 4. Change app-level secrets too (session/JWT/HMAC signing keys). Note that this logs users out and invalidates existing signed tokens. 5. Recreate Railway CLI and CI tokens, and reconnect the GitHub integration if Railway prompts you to. 6. Redeploy: deploys triggered during the pause weren't replayed automatically, so trigger them again and confirm the new build is live. What to check after: - Provider usage dashboards and billing for spikes since October 21, especially AI API keys, which attackers resell or use for bulk queries. - Database logs for logins from unfamiliar IPs, cloud audit logs (e.g. CloudTrail) for activity from the old keys, and payment/email provider logs. - Railway's status page and your email for Railway's follow-up details on the affected scope. Sources: https://blog.railway.com/p/security-disclosure-wednesday-october-21st https://runtimewire.com/article/railway-security-disclosure-environment-variables-october-2026 https://status.railway.com