Uncanny Automator Breach Exposed Customer Data and Distributed Backdoored Plugin
Summary
Uncanny Owl confirmed an intrusion that exposed customer records and sent backdoored Pro plugin version 7.3.0.5 to some WordPress sites. The company removed access, released clean version 7.3.0.6, and urged affected users to remediate.
Key points
- Uncanny Owl said an attacker exploited third-party software on automatorplugin[.]com on June 12, 2026, and accessed part of the company's infrastructure.
- The attacker tampered with the Pro update package and licensing database; the source code repository was not affected.
- Backdoored Pro version 7.3.0.5 reached fewer than 6% of sites during an approximately 21-hour window; Uncanny Automator Lite was unaffected.
- Exposed customer data included names, email addresses, license keys, and associated website URLs. The company said it did not store payment card numbers and stored passwords as cryptographic hashes.
- Uncanny Owl removed the attacker's access on June 13 and released a verified-clean 7.3.0.6 build. Its investigation, completed June 14, found no signs of reinfection.
- The company removed rogue administrator accounts, malicious database entries, and scheduled tasks, and rotated exposed credentials and keys. Sites running 7.3.0.5 require remediation beyond an in-place update.
Article Details
- Victim Organization
- Uncanny Owl
- Victim Domain
- automatorplugin.com
- Incident Type
- Company-system compromise, customer-data breach, and software supply-chain compromise through a backdoored plugin update.
- Incident Date
- 2026-06-12
- Data Types Exposed
- Names
- Email addresses
- License keys
- Associated website URLs
- Affected Records
- Not disclosed
- Operational Impact
- A backdoored Uncanny Automator Pro version 7.3.0.5 was distributed to fewer than 6% of sites during an approximately 21-hour window. The company said sites running the compromised build should be treated as compromised. Uncanny Owl removed the attacker’s access, released version 7.3.0.6, and reported no signs of reinfection after its investigation. The source code repository was not affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed