Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Summary: Railway disclosed that an unauthorized third party may have accessed encrypted customer environment variables and in some cases obtained their decrypted contents, affecting a subset of users it did not quantify. Railway later said it became aware on October 20, 2026 at 7:53 p.m. UTC of a sustained and targeted campaign to obtain AI provider API keys for distillation attacks, and assessed that environment variables tied to at most 1.85% of all workspaces - about 100,000 - may have been compromised.
Bottom line: Researcher Taylor Monahan reported that the incident let attackers drain cryptocurrency wallets whose private keys were stored on Railway, with the first known theft transaction at 7:36 p.m., at least two hours before the incident was officially disclosed. Railway worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, and Stripe to revoke potentially compromised keys, and is telling all users to revoke and reapply sensitive environment variables stored before October 21, 2026.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026