Railway forensic incident report: October 21 security attack

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsRailway publishes detailed forensic follow-up: Railway reports that the intruder read 353 build histories on October 20, separately from the upper-bound 1.85% environment-variable decryption exposure and 1,852 exposed linked-account tokens.

  Customer impact: 353 builds, upper bound 1.85% of workspaces, and 1,852 linked-account tokens

• supportsRailway publishes detailed forensic follow-up: Railway traced the Oct 20 entry through build-host filesystem exposure, an over-trusting Temporal client identity, and a misconfigured cloud OIDC binding that led to customer-variable decryption.

  What happened; Timeline: First entry point and Secondary entry point

• supportsRailway publishes detailed forensic follow-up: Railway estimated at most 1.85% of workspaces potentially impacted, linked-token exposure for 1,852 users, and approximately $740,000 unauthorized AI usage; the first figure is an upper bound.

  Customer impact; Attack intent