Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
Railway
cloud PaaS / developer infrastructure · U.S. (CA); customers global
What happened
Customer environment variables (no more than 1.85% of about 100,000 workspaces, per Railway), which can hold AI provider keys, payment keys, database and registry credentials and wallet keys; CI credentials and decrypted build artifacts.
Customers had to rotate every sensitive variable; a 23 to 24 Oct batch sent at OpenAI's and Anthropic's request also revoked freshly rotated keys; new signups paused 12 days. Railway says it cannot refund spend on compromised keys.
What remains unknown
- Final forensic report
- Count of workspaces with decrypted secrets
- Any AI provider confirmation of revocations or abuse volume
- Signup reopening date
Losses: unknown. CLAIMED only: one Railway forum user reports USD 20 of prepaid Google Gemini credits drained (27 Oct), and a reply reports an OpenAI refund with no amount or breach link; an independent on-chain trace attributes USD 381,503 from 231 wallets to Railway-stored keys by inference, not confirmed by Railway.
Capital around this company
DFX holds no verified lender or owner record for this organization yet. That is a gap in our coverage, not evidence that none exists.
Sources
- Railway status incident O1VGXWU5: Railway Recovery after October 21 Incident · 2026-10-29T15:45Z (newest update)
- Railway blog index (newest posts 23 Oct) · 2026-10-23 (newest)
- Railway: Preliminary Report: Oct 21st Security Incident (baseline v3-s03, not reopened) · 2026-10-22 (addendum 2026-10-26)
- Railway Station forum: Railway Security Breach: Anyone had luck getting reimbursed for stolen API credits? · 2026-10-27
- railway_blockchain_incident on-chain trace (baseline v3-s06, not reopened) · undated
- Wiz: Black October for AI Developer Platforms · 2026-10-30
Does Railway touch your portfolio?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.