2026 TeamUpdraft — customer database and UpdraftCentral keys stolen; WordPress sites backdoored
Data compromised
Customer database (company believes accessed): names, email and billing addresses, order history, hashed account passwords, 2FA settings, and UpdraftCentral, UpdraftVault and UpdraftClone connection keys. No card data stored. Backdoor plugins installed on connected WordPress sites; Patchstack logged at least 99 variants.
Technical writeup
Verified TeamUpdraft advisory (Oct 19, updated Oct 20): unauthorized access identified over the weekend of Oct 17–18; the company believes its customer database was accessed. Patchstack saw backdoor installs start Oct 18 15:32 UTC, delivered as signed UpdraftCentral commands using valid keys; the plugins run arbitrary code and create administrator accounts. About 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key (BleepingComputer estimate: ~400,000 sites potentially exposed). UpdraftPlus 1.26.13/2.26.13 disconnects older connections (Nethemba reports a bug stopped 1.26.12/2.26.12 removing keys). Plugin downloads, own-storage backups and self-hosted UpdraftCentral not affected. recordsAffected 0 (customer count not disclosed).
Root cause
Unauthorized access to teamupdraft.com over Oct 17–18 (route not disclosed). Stolen UpdraftCentral cloud connection keys let the attacker send signed remote-management commands to customer WordPress sites.
References
- https://teamupdraft.com/blog/security-incident-october-2026/
- https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
- http://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/
- https://nethemba.com/updraftcentral-backdoor-analysis/