Railway Preliminary Report: Oct 21st Security Incident
Railway’s preliminary account says an attacker accessed internal systems from October 20 to 22, and that a subset of customer environment secrets were decrypted. The company estimates up to 1.85% of workspaces—about 100,000—may have had variables exposed; it recommends rotating sensitive values stored before October 21. Railway says running customer services stayed online, though builds and deployments were paused, and its forensic investigation is ongoing.
The seven-comment Lobsters thread questioned the company’s framing of services staying online, highlighted gaps in logging and uncertainty about which secrets were decrypted, and challenged the stated motive of AI-model distillation. These are commenters’ concerns, not confirmed findings; Railway’s report remains preliminary.