REPORTED DEVELOPMENT
On 21 October, Railway said an unauthorised party might have accessed some customer environment variables, including decrypted information, and recommended rotating platform-held credentials and checking unusual activity.
At 14:50 UTC on 22 October, the platform remained in Major Outage status. Pro and Enterprise deployments were available, some slowly, while restoration for other plans continued. Railway had also invalidated all its API tokens.
WHY IT MATTERS TO THE MARKET
External-provider credential custody and application continuity are material operating risks.