MeridianMeridian

Railway Discloses Security Incident Potentially Exposing Encrypted Environment Variables Across 100,000 Workspaces

Railway reported a security incident detected on October 20, 2026, involving unauthorized access to systems storing customer environment variables. Attackers may have obtained both encrypted variables and, in some cases, their decrypted contents, which often include API keys, database credentials, and authentication tokens. The company estimated that up to 100,000 workspaces, representing 1.85% of the platform total, could have been affected. The probable objective was theft of API keys belonging to AI service providers. Railway collaborated with external vendors including GitHub, GitLab, Anthropic, OpenAI, and Stripe to proactively revoke potentially compromised keys. No user accounts were accessed, though source code exposure could not be ruled out. Deployments were paused during the investigation and later restored, with customers advised to rotate credentials and review logs.

ekurakTranslated from Polish

Read at source

Railway has published detailed information about a security incident that occurred on its cloud platform for running applications, services, and databases. On 20 October 2026, the company detected unusual activity in systems holding customer environment variables.

Unauthorized parties may have gained access to encrypted environment variables and, for a subset of them, their decrypted values. Customers commonly store API keys, database credentials, and other secrets in these variables.

According to Railway, the maximum number of potentially impacted workspaces reached 100,000, equivalent to 1.85% of all workspaces on the platform. The likely goal of the intrusion was to obtain API keys from AI providers.

The company worked with external partners to preemptively invalidate API keys stored on the platform. Railway confirmed that attackers did not obtain access to user accounts, although access to source code could not be entirely excluded.

Following detection, all deployments were suspended while the investigation proceeded. On 22 October users received direct notifications, and a second public statement clarified that the attack window ran from 20 October at 15:58 until 22 October at 05:32.

Railway coordinated key revocation with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe and additional providers. The firm restored the ability to create builds and deploy new versions after confirming the attacker no longer had internal system access.

Customers are advised to audit environment variables, rotate stored credentials, and monitor service logs for anomalous activity. The company also recommends restricting tokens to specific IP addresses and limiting permissions wherever possible.

OpenAIAnthropicGitHubStripeGitLabRailway
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Breaches & Leaks

Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users
Breaches & Leaks

Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users

Istyle Inc. announced on November 2 that unauthorized access to its @cosme platform had occurred, with confirmation of the data leak received on October 28. Partial member information belonging to roughly 3 million users registered under the @cosme common ID was exposed to external parties. The compromised data fields include user IDs, nicknames, full names in both kanji and kana, postal codes, addresses, telephone numbers, email addresses, gender, dates of birth, skin type, and hair type. Istyle is contacting all affected customers individually through known contact channels, with the process expected to conclude by November 6. The company has engaged a third-party security firm to determine the root cause and full scope of the incident while implementing measures to limit further damage. Future remediation steps will be developed based on the findings of the external investigation.

ScanNetSecurityNov 5, 2026Translated from Japanese

MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information
Breaches & Leaks

MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information

Ryohin Keikaku Co., Ltd. has issued a second report on the unauthorized access to its MUJI App that was first disclosed on October 30. The breach initially involved customer email addresses, dates of birth, and gender, but further investigation revealed that names, addresses, and phone numbers were also exposed for some users of both the MUJI App and the Muji online store. Credit card details linked to the MUJI Card issued by Credit Saison, as well as partial card information registered directly in the app or store, may have been accessed by external parties. Approximately 27.26 million records containing basic personal data are affected, with 520,000 of those also including full address and phone details. In addition, full credit card numbers, MUJI Card IDs, and birth dates for about 1.09 million MUJI Card members who joined before July 2021 are potentially compromised, of which 345,000 cards remain valid. The company has blocked further unauthorized access and is monitoring its systems while notifying affected customers individually by email or mail.

ScanNetSecurityNov 5, 2026Translated from Japanese

DigiCert Discloses Unauthorized Access Exposing Customer Passports, Driver's Licenses and Personal Data
Breaches & Leaks

DigiCert Discloses Unauthorized Access Exposing Customer Passports, Driver's Licenses and Personal Data

Certificate authority DigiCert has confirmed a data exposure incident involving customer identity documents and personal information. The company discovered unauthorized access to an internal system that stored identity validation materials supplied by customers. The affected system originally resided in a VPN-restricted network but was moved on 4 February 2025 to a publicly reachable network without proper access controls. Attackers could create accounts without multi-factor authentication, and one such account was later found to have accessed customer records. DigiCert identified the external exposure on 21 June, applied fixes on 2 July, and confirmed data access on 19 October. The incident primarily affected names, business email addresses, phone numbers and addresses, while a small subset of accounts also had copies of passports, driver's licenses, utility bills and other identity documents exposed.

Security.NLNov 5, 2026Translated from NL