TeamUpdraft says it identified unauthorized access to teamupdraft.com on Oct. 17 and 18, and says the attacker used connections to customer sites to create admin accounts and install malicious plugins. If you run UpdraftPlus, update it, delete its UpdraftCentral key, and check each site for unknown admins and plugins.
What happened
TeamUpdraft says it closed the route in, signed out accounts and replaced keys. It believes its customer database was accessed. That database holds:
- Names, emails, billing addresses and order history
- Password hashes and two-factor settings
- Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
No card details were exposed, because payments go through Stripe and PayPal. The UpdraftPlus plugin and its downloads were not affected, and self-hosted UpdraftCentral is unaffected.
What is still unknown
TeamUpdraft says the attacker used a connection to user sites to add admins and plugins, and "the extent of that is unknown". It gives no count of affected sites. It has hired an outside security firm and contacted the police. As of its Oct. 20-21 updates, it says there is currently no evidence the attacker still has access.
The security firm Patchstack separately tracked the campaign from Oct. 18 to Oct. 19 and saw 99 different backdoor plugin names. Treat any plugin you do not recognize as suspect, whatever it is called.
Do this on each site
The plugin fix is out. The WordPress.org changelog lists 1.26.12 as revoking UpdraftCentral Cloud keys created before the incident, and 1.26.13 as applying that revocation properly. Premium is 2.26.13. WordPress.org pushed the free update automatically.
- Log in through the site's own WordPress dashboard, not through UpdraftCentral.
- Update UpdraftPlus to the latest version (1.26.13 free, 2.26.13 Premium).
- Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key.
- Open Users and remove any administrator you do not recognize.
- Open Plugins, including the Must-Use tab, and remove anything you did not install.
- Change every administrator password.
- If anything looks wrong, consider restoring a backup from before Oct. 17.
- Reconnect the site to UpdraftCentral if you still use it.
TeamUpdraft's Oct. 21 update says all UpdraftPlus Premium users should run the user and plugin checks, even if they never used UpdraftCentral.
Do this for your account
If you have a teamupdraft.com account, type the address into your browser rather than clicking an email link, and change your password. Change it anywhere else you reused it, and reset two-factor authentication. Expect phishing emails that use your name and order history.
- UpdraftVault: reconnect with new credentials under Settings > UpdraftPlus > Settings > UpdraftVault. Click Connect under "Already got space?".
- UpdraftClone: keys were replaced, so copy the new ones from My Account.
- Free plugin, no teamupdraft.com account: no action beyond keeping the plugin updated.
Why it matters
A backup plugin is a trusted, privileged guest on a site, and an UpdraftCentral key lets a remote dashboard act on it. A stolen key meant the attacker could skip your login screen. The trade-off is that remote management saves time for agencies, but each connection is also a standing door that needs revoking when the vendor is breached.
Do not wait to learn whether your connection was cut off. Delete the key yourself. For another recent security incident, see OpenCode's Console security breach, and browse more in Computing.
