Railway Platform Breach Exposed 100,000 Workspaces to Stolen AI API Keys and Model Distillation Attacks

Railway disclosed a significant security incident on October 21, 2026, revealing that an unauthorized party accessed encrypted environment variables containing sensitive credentials for approximately 100,000 workspaces—roughly 1.85% of its customer base. The attacker, operating between October 20-22, specifically targeted high-value API keys from Anthropic (Claude), OpenAI, OpenRouter, and other AI providers, as well as database passwords, cloud credentials, and cryptocurrency private keys.