What does encrypted at rest mean?

That data is encrypted on the provider's disks. If the provider holds the key, an attacker inside its systems may be able to read the data too. The useful question is who holds the key.

What happened at Railway in October 2026?

Between October 20 and 22, part of the environment variables customers store there was decrypted. A preliminary report said at most 1.85% of workspaces may have been exposed, and users were asked to rotate their secrets.

How do I limit the damage of a provider breach?

List the secrets you keep at providers, give each the narrowest scope and shortest life, and keep a rotation list.

News · Security · November 12, 2026

Breach Briefing: when your provider holds the key

In October 2026 a cloud platform and a backup tool lost customer secrets and access. Why encryption held by the provider is not the same as your key.

DRIVE 369 DAO · 3 min read

A Breach Briefing: two incidents from October 2026, what is public, and the question they share.

What happened

According to an October 2026 roundup by Strobes:

Railway (October 20 to 22). The cloud platform caught an attempted privilege escalation in its build infrastructure and declared an incident on October 20. Part of the environment variables its customers store there was decrypted. A preliminary report said at most 1.85% of workspaces, about 100,000, may have been exposed, and Railway asked all users to rotate every secret kept as an environment variable.
ConnectWise Cloud Backup (October 15 to 17). A stolen credential for its backup app was used to sign in to customers' Microsoft 365 tenants. Huntress disclosed sign-ins in 162 tenants on October 16 and saw activity across almost 1,000 by the 17th, with more than 300 successful sign-ins. The sign-ins were application-only, so user two-factor authentication did not apply. ConnectWise said it found no evidence that stored backups were accessed.

Other October incidents, such as an attack on a cloud provider hosting an AI company's machines, were reported by aggregators with less detail, so we leave them out.

The shared lesson

Both cases involve a provider that held something it could use: decrypted secrets in one, a standing credential with broad access in the other. In the first, the provider's own systems could decrypt your data, so an attacker inside them could too. In the second, one credential opened many customers.

"Encrypted at rest" can mean many things. The useful question is: who holds the key?

Where the key lives	If the provider is breached
The provider	An attacker in the provider's systems may read your data
You, on your device	The attacker gets sealed blocks they cannot open

How Ghostdrive is built around that question

Files, notes, messages and AI memory are encrypted on your device. Nodes, relays and gateways see ciphertext only.
Every item in Pass has its own random key and sits inside an encrypted box, including the title and the website. Storing an API key there instead of in a platform's environment variables puts it outside a platform's decryption reach.
A node keeps your sealed blocks and has to prove it still has them. If it fails, the file is rebuilt elsewhere (how storage is checked).

Honest limits: if you paste a secret into a service, that service has it. Ghostdrive protects what you keep in it, not what you hand to others, and the testnet contracts have an audit pending.

Use case: a small team with a cloud app

The team keeps its payment and AI keys as environment variables on a platform. After an incident they have to rotate all of them in a hurry. A better habit: keep the master copies in a sealed manager, give the platform keys with the narrowest scope and shortest life, and know the one place where all keys can be rotated.

Do this week

List every secret you keep as an environment variable at a provider, and note what each one opens.
Give each the narrowest scope. Remove standing admin access you do not need.
Keep a rotation list: which key, where it lives, how to replace it.

Academy: start here · Drive · Security and audits

Questions

What does encrypted at rest mean?: That data is encrypted on the provider's disks. If the provider holds the key, an attacker inside its systems may be able to read the data too. The useful question is who holds the key.
What happened at Railway in October 2026?: Between October 20 and 22, part of the environment variables customers store there was decrypted. A preliminary report said at most 1.85% of workspaces may have been exposed, and users were asked to rotate their secrets.
How do I limit the damage of a provider breach?: List the secrets you keep at providers, give each the narrowest scope and shortest life, and keep a rotation list.