October 22, 2026 · 7 min read · Security

A company you've never heard of got hacked. That's not the scary part.

This week, a company most of you have never heard of got hacked. It’s called Railway.

And honestly? You don’t really need to care about Railway. But you should care about what it tells us.

Railway is run by people who do this stuff for a living. They’re good at it. And they still got hit. So what about your local pizza place, the one that lets you order on its website? Or the small food delivery app in your town?

That’s what I want to talk about.

What happened

Railway is a place where developers run their apps. Think of it like a landlord. Lots of different apps “live” in its building, and you’ve probably used some of them without knowing.

Every app needs keys to get into other things. A key to the database where customer details are kept. A key to the payment system, like Stripe. A key to an AI service, like OpenAI. Developers keep those keys with Railway so their apps can use them.

On October 21, Railway said an attacker got into the systems that hold those keys. The keys were locked (encrypted), but for some customers the attacker was able to unlock them. Railway hasn’t said how many customers, or how the attacker got in.

Diagram: an attacker unlocks the keys Railway holds for apps. A database key leads to your data being exposed, a payment key to strange charges, and an AI key to surprise AI bills. — One break-in, many doors. Each key opens a different service, and each service leads back to you.

Railway paused all app updates while it investigated, which froze a lot of apps in place. It told every customer to change all their keys, and it posted guides on checking for strange use of OpenAI, Anthropic and Stripe accounts. One security researcher also reported that crypto wallets with keys stored on Railway were drained.

That’s a bad breach. But it’s not the part that worries me most.

The real risk is the apps you use every day

Here’s my take. The biggest risk to you isn’t a tech platform you’ve never heard of. It’s the normal apps that hold your name, your email, your address and your card.

Take that local pizza place with online ordering. Its website probably runs on a platform like Railway or Vercel. It keeps your name, address and order history in a database. It takes your card through a payment tool like Stripe.

Each of those services has strong locks of its own. But the pizza place holds the keys to all of them. If those keys leak, the attacker doesn’t need to break any lock. They just walk in as the pizza place. It’s like giving someone your online banking login: the bank’s security can’t help you, because to the bank it looks like you.

And unlike Railway, the pizza place doesn’t have engineers who think about security all day. Security is one job among fifty, if it’s a job at all.

I think part of the problem is that we’ve got used to the idea that someone else is protecting our data. That’s made us a bit complacent. In real life, most of us have good instincts. You’d never keep your card’s PIN in your wallet, because if someone steals the wallet, they can empty your account. But online, we hand our details to dozens of services and never think about where the keys are kept. Railway was, in a way, a wallet with the PINs for lots of apps inside.

The stakes can be a lot higher than a pizza order, too. Apply for a mortgage or a rental and you’ll hand over your ID, payslips and bank statements. I’m sure those services work hard on security. But I think it’s very hard for anyone to fully protect themselves right now.

And AI is moving faster than a lot of these services can keep up with. AI accounts are now worth stealing, and defenders are still working out how to use AI to fight back. You don’t have to take my word for it. Look at what happened to OpenCode, an AI coding tool, the same week.

Attackers broke into an old OpenCode system and took the AI keys of 1.4% of its Console users. Some people were hit with bills of more than $1,000, because the attackers used their keys to run AI on their accounts.

Then it got worse. OpenCode’s co-founder said the attackers kept trying to break in for 48 hours without a stop. The team used AI tools to investigate, but those tools refused to keep going once the attack code set off their safety filters. Things only got better when OpenCode was given access to Daybreak Blue, an OpenAI program that gives vetted defenders models that are less likely to refuse security work.

So the attackers were after AI, and the defenders’ own AI tools said no. That’s the gap I’m worried about.

The AI labs are trying to close it. Anthropic gave its unreleased Mythos model to around 50 companies to find and fix security holes, and OpenAI and Google run similar programs. And Railway thinks its own attack was part of a wider campaign aimed at exactly this: getting into AI accounts and running AI on someone else’s bill.

If well-funded tech companies are struggling with this, smaller apps are going to struggle more.

How to protect yourself

You can’t stop an app from getting hacked. But you can make sure one hack doesn’t open every door.

Diagram: with the same password everywhere, one leaked shop password unlocks your email, bank and shop. With a password manager and 2FA, email and bank stay safe and 2FA stops the login at the shop. — The same leak, two different outcomes.

Use a password manager, and a different password for every site. The same password everywhere is like using the same PIN on every card. With different passwords, one leak gives away one account, not all of them.
Turn on 2FA, or passkeys where you can. An account with no 2FA is like a card with no PIN. With 2FA, a stolen password on its own is not enough to get in.
Don’t keep passwords in your email or notes app. That’s the PIN on a sticky note in your wallet. Keep them in the password manager.
Give apps less. Skip the optional fields. Don’t save your card in every shop. Delete the accounts you don’t use any more.
Be careful with “your account was affected” emails. Scammers love big news like this. Go to the website yourself instead of clicking the link.
Check your statements. Look for small charges you don’t recognise. They’re often a test before a bigger one.

What companies should do

If you run a business or build apps, there’s another side to this. You can’t promise a key will never be stolen. But you can make a stolen key a lot less useful.

Diagram: five steps between a stolen key and little damage: keep less data, limit each key, cap spending, swap keys fast, and tell customers fast. — Each step makes a stolen key do less harm.

Keep less data. You can’t leak what you don’t have. Delete old customer data, and don’t collect what you don’t need.
Know where your keys live. Keep a simple list: which services you use, who has access, and where the keys are kept.
Limit each key. Give every key only the access it needs, and set spend limits on AI and cloud accounts so a stolen key can’t run up a huge bill.
Be ready to swap every key fast. Railway asked its customers to change all their keys in a day. Could you?
Tell customers quickly and clearly. Railway posted the same day, with a clear list of what to do. That’s the bar.

And if someone else built your app or website, send them one message today: “Do we use Railway for anything? If yes, have you changed our keys?” A good developer will have done it already, and will be glad you asked.

The short version

The hacks that hurt you won’t usually be at companies you’ve never heard of. They’ll be at the apps you use every day.

So protect yourself: a different password for every site, and 2FA. And if you run a business, keep less data and know where your keys live.

Sources

OlderWhy I'm writing my notes here