Railway says an attacker decrypted variables for at most 1.85% of workspaces, about 100,000

What changed: On 10 November, Railway published its postmortem of an attack that ran from 20 to 21 October. Railway says the attacker decrypted customer variables for at most 1.85% of workspaces, about 100,000. The attacker also decrypted GitHub OAuth tokens and AI provider keys for 1,852 users. Railway puts unauthorized spend on stolen keys at "~$740,000". Its forensics found no sign that anyone accessed customer databases.

Why it matters: If you run self-hosted n8n or any internal tool on Railway, its API keys live in Railway variables. Railway says the attacker went after AI provider keys, and the same search also matched cloud, database and payment credentials.

What to do: If you had anything on Railway before 21 October, rotate every key and password stored in its variables this week. Start with AI provider and payment keys. Then check your GitHub account for app access you don't recognize.