TeamUpdraft Data Breach Exposes UpdraftCentral Keys Used to Backdoor WordPress Sites
Summary
TeamUpdraft says attackers likely accessed its customer database, including UpdraftCentral keys. Patchstack observed signed commands using stolen keys to install backdoors on WordPress sites; the company has closed the access route and issued updates.
Key points
- TeamUpdraft says its customer database was likely accessed over the weekend of October 17–18; it has not disclosed the entry point or number of affected accounts.
- The database included names, email and billing addresses, order history, hashed passwords, two-factor settings, and connection keys. TeamUpdraft says it does not store payment-card details.
- Patchstack observed signed UpdraftCentral commands installing malicious plugins on WordPress sites between October 18 and 19.
- The reported backdoor creates a hidden editor account with plugin-install privileges and uses a cookie to log in, bypassing the login form and two-factor authentication.
- TeamUpdraft says all account holders should assume their data was exposed. UpdraftCentral cloud users face the highest risk; self-hosted UpdraftCentral and backups in Google Drive, Dropbox, or Amazon S3 are not affected.
- TeamUpdraft advises users to change reused passwords and reset two-factor authentication. Cloud users should secure connected sites, update UpdraftPlus to the specified releases, and remove old connection keys.
- The company says it closed the access route, signed out accounts, rotated or replaced keys, and reported the incident to the UK Information Commissioner's Office.
Article Details
- Victim Organization
- TeamUpdraft
- Victim Domain
- teamupdraft.com
- Incident Type
- Customer database breach involving UpdraftCentral connection keys, followed by malicious backdoor deployment on WordPress sites using signed commands
- Incident Date
- 2026-10-17
- Data Types Exposed
- Names
- Email addresses
- Billing addresses
- Order history
- Hashed passwords
- Two-factor authentication settings
- UpdraftCentral connection keys
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Patchstack observed signed commands installing malicious plugins between 2026-10-18 and 2026-10-19. Nethemba found the plugin on two of its own fully patched sites. The backdoor creates a hidden editor account with plugin-install capability and uses a cookie to log in, bypassing the login form and two-factor authentication. The article reports no payment-card data exposure; TeamUpdraft said it does not store card details.
- Ransom Or Extortion
- Unknown
- Claim Status
- alleged
Products
UpdraftCentralUpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress SitesUpdraftCloneMost important, it contains connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.UpdraftPlusUpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress SitesUpdraftVaultMost important, it contains connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.WordPressUpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites