TeamUpdraft breach: customer database believed accessed, WordPress site keys included
TeamUpdraft said on October 19, 2026 that unauthorised access to teamupdraft.com over October 17-18 led it to believe its customer database was accessed, including names, email and billing addresses, hashed passwords and UpdraftCentral connection keys that attackers have since used to install backdoor plugins on connected WordPress sites.
What happened
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said on October 19, 2026 that it had identified unauthorised access to the teamupdraft.com website over the weekend of October 17-18, 2026. The company said it closed the access route, signed out every account, replaced the keys and credentials that could have been affected, and reported the incident to the UK Information Commissioner’s Office and other relevant authorities. It said: “We believe our customer database was accessed.” The UpdraftPlus plugin itself and its downloads were not affected, self-hosted UpdraftCentral is not affected, and the company does not store card details — payments are handled by Stripe and PayPal. Separately, security firms Patchstack and Nethemba reported that an attacker holding genuine UpdraftCentral dashboard keys used them on October 18-19 to send signed commands that installed backdoor plugins on connected WordPress sites; Patchstack said its telemetry recorded installations between 15:32 on October 18 and 09:23 on October 19, under 99 distinct backdoor plugin names.
Who is affected
TeamUpdraft customers, and WordPress sites connected to its UpdraftCentral remote-management service. The company said the database it believes was accessed holds names, email addresses, billing addresses and order history, account passwords stored only in hashed form, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft has not disclosed how many customers are affected. Patchstack notes that the UpdraftCentral client ships inside every copy of UpdraftPlus — a plugin with more than four million active installations — and that a site holds a key if it was connected to UpdraftCentral, which can also happen through a TeamUpdraft.com account connection; that installation figure is not a count of affected sites, and sites with no UpdraftCentral key do not accept these commands.
How serious
The concrete risk for a connected WordPress site is takeover without its owner’s password. An UpdraftCentral connection key lets signed commands run on the site with the permissions of the user who created the connection, and Patchstack and Nethemba report the stolen keys were already used to install backdoor plugins designed to create a hidden account with administrator-level capabilities and log the attacker straight in, bypassing the normal login form. A backdoor account can outlive the plugin that created it, so a taken-over site can be used to steal its visitors’ and customers’ data or serve malware in the owner’s name. For TeamUpdraft account holders, the hashed passwords, email addresses, billing addresses and order history in the database also enable targeted phishing that impersonates TeamUpdraft with details that check out, and credential-stuffing attempts anywhere the same password was reused.
What to do now
Change your teamupdraft.com password — type teamupdraft.com into your browser yourself rather than following a link — change that password anywhere else you reused it, and reset your two-factor authentication in My Account. For every WordPress site you run, log in to the site’s own dashboard, not through UpdraftCentral: update UpdraftPlus to the latest version (Nethemba, which checked the release code, says version 1.26.12 does not delete the old keys and that 1.26.13 or later is the working release), then delete the UpdraftCentral connection key yourself in Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, whether or not you updated. Check Users for any account you do not recognise — including accounts listed as Editor — and check Plugins, including the Must-Use tab, for anything you did not install, and remove what you find. Change the passwords for all administrator accounts, and if you find anything suspicious, consider restoring the site from a backup taken before October 17, 2026, and re-authorise your remote storage and change any storage access keys as the company advises. Do not reconnect a site to UpdraftCentral until those steps are done.
Sources: TeamUpdraft · Patchstack · Nethemba