Cybersecurity
TeamUpdraft breach exposed UpdraftCentral keys
TeamUpdraft said unauthorised access to its website may have exposed customer connection keys and database details, while Patchstack and Nethemba described later abuse of those keys against WordPress sites.
- TeamUpdraft said it found unauthorised access to teamupdraft.com over the weekend of 17 and 18 October and then closed the access route, signed out accounts and replaced affected keys and credentials.
- The company said attackers may have reached its customer database, which held names, email addresses, billing addresses, order history, hashed passwords, 2FA settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
- Patchstack said it observed an attacker using valid UpdraftCentral dashboard keys to issue commands that installed backdoor plugins on connected WordPress sites during an 18-hour period on 18 and 19 October 2026.
- Nethemba said the rogue plugin created a WordPress user, granted extra permissions and could remain useful even after the plugin itself had been removed.
TeamUpdraft said it found unauthorised access to its website over the weekend of 17 and 18 October. It said it cut off the access path, signed out every account and replaced keys and credentials that might have been exposed.
The company said the affected database may have included names, email addresses, billing addresses, order history, hashed passwords stored only in hashed form, 2FA settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said no financial data were stored there and that payments were handled by Stripe and PayPal.
TeamUpdraft said it had released UpdraftPlus 1.26.13 and 2.26.13 to disconnect earlier UpdraftCentral links made before 10 p.m. BST on 18 October 2026. It also said it reported the incident to the U.K. Information Commissioner's Office and other authorities.
Patchstack said it saw an attacker with valid UpdraftCentral dashboard keys send plugin-install commands to connected WordPress sites over an 18-hour window on 18 and 19 October 2026. Dave Jong said the command travelled over the plugin's remote procedure call channel and led WordPress to install and activate the supplied plugin.
Nethemba said the backdoor checked for a URL parameter and token, created a user called data-ops43 with the display name Site Tools, and gave it extra permissions. It also said an early version had a coding error that caused some sites to return a 500 error, and that Wordfence later set out which sites could be affected if they had an active UpdraftCentral cloud connection and the relevant UpdraftPlus version.
Named in this story
People
- Dave Jong
- Patchstack researcher who described the plugin upload command
- Benjamin Harris
- watchTowr chief executive who commented on the PHP flaws
Companies
- TeamUpdraft
- said its website was accessed without authorisation and issued the incident response
- Stripe
- handled TeamUpdraft's payment processing
- PayPal
- handled TeamUpdraft's payment processing
- Patchstack
- said it saw valid keys used to install backdoor plugins on connected sites
- Nethemba
- first detected the attack in the wild and analysed the backdoor
- Wordfence
- published its own analysis of which sites may have been affected
- watchTowr
- was cited through its chief executive on the PHP issues
- Huntress
- commented on the implications of PHP's ubiquity
Governments and agencies
- U.K. Information Commissioner's Office (ICO)
- received TeamUpdraft's incident report
Products and systems
- UpdraftPlus
- WordPress backup plugin whose client component was shipped in every copy
- UpdraftCentral
- remote management service whose connection keys were involved
- UpdraftVault
- backup service whose connection keys were rotated and disconnected
- UpdraftClone
- cloning service whose client keys were replaced
- WordPress
- platform on which the backdoors were installed
- Rank Math PRO WordPress plugin
- was cited in a separate supply-chain attack example
- PHP
- was the subject of a separate advisory about two critical vulnerabilities
How the source tells it
The article is a straightforward incident report with advisory detail; it does not rely on obvious emotive framing.
No emotive framing was found in the original.