What happened
Railway disclosed (initial report 2026-10-21, preliminary report 2026-10-22) that a sustained and targeted campaign breached its systems; early evidence indicated an attempt to obtain AI provider API keys to perform distillation attacks, and the actor had access to abliterated models and substantial compute. The attacker extracted and decrypted a subset of stored environment variables. This is part of a wave of intrusions targeting platforms that store credentials for AI inference providers.
Why it matters
This is a direct attack on the AI inference economy: stealing AI provider API keys to run distillation (or LLMjacking) at the owner's expense. Because Railway stores the env vars that hold those keys for thousands of development and AI workloads, the incident exposes downstream AI-provider credentials and cloud identities, not just the platform itself.
Attack vector
The attacker escalated privileges through Railway's build infrastructure after 2026-10-20 13:58 UTC, ultimately decrypting encrypted environment variables that included AI provider API keys, with the stated goal of performing distillation attacks (and the pattern of LLMjacking / stealing keys to run inference at the owner's expense). Stolen keys were used to drain cryptocurrency wallets whose private keys were stored on Railway.
Affected systems
Railway developer platform accounts and stored environment variables/API keys; any downstream AI providers, cloud accounts, and services whose credentials were held in Railway.
Mitigation
Rotate all environment variables, API keys, private-registry credentials and secrets stored in Railway (recommended for all users who signed up before 2026-10-21); review service logs for unusual activity; Railway has rotated bucket credentials and invalidated Railway API tokens.