Railway incident
Clarification: Recent Oct 24 API key revocations are precautionary
Ongoing since 01:57 PM UTC, affecting Railway (Support & Community — station.railway.com).
Railway is not currently under attack. Recent API key revocations by AI providers are precautionary actions in response to the October 21 incident, not a new security incident. On October 23, after the attacker’s access had been fully removed on October 22 at 03:32 UTC, AI providers requested another batch of potentially affected keys. We provided that batch to OpenAI and Anthropic, but because we could not filter keys by when they were added, it inadvertently included newer keys. As a result, providers may have revoked replacement keys you created after the incident. These revocations do not indicate that your replacement keys were compromised. You should also receive communications directly from the providers taking action, explaining their response and any steps you need to take. If a provider revoked your key, create a replacement, update the corresponding Railway environment variable, and redeploy the services that use it. If your keys are still working, this notice does not require you to repeat completed rotations. We’re sorry for the confusion and additional disruption.
Affected components
Update timeline
- investigating Oct 24, 2026, 01:57 PM UTC
Railway is not currently under attack. Recent API key revocations by AI providers are precautionary actions in response to the October 21 incident, not a new security incident. On October 23, after the attacker’s access had been fully removed on October 22 at 03:32 UTC, AI providers requested another batch of potentially affected keys. We provided that batch to OpenAI and Anthropic, but because we could not filter keys by when they were added, it inadvertently included newer keys. As a result, providers may have revoked replacement keys you created after the incident. These revocations do not indicate that your replacement keys were compromised. You should also receive communications directly from the providers taking action, explaining their response and any steps you need to take. If a provider revoked your key, create a replacement, update the corresponding Railway environment variable, and redeploy the services that use it. If your keys are still working, this notice does not require you to repeat completed rotations. We’re sorry for the confusion and additional disruption.
Your product runs on more than Railway
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services