Updated 19 October 2026. This article is based on TeamUpdraft’s official statement of 19 October. The investigation is ongoing and the vendor is updating its own page as it goes — before acting on the critical steps, check the original incident page as well.
Over the weekend of 17–18 October, someone gained unauthorised access to teamupdraft.com — the company behind UpdraftPlus, the most widely installed WordPress backup plugin. According to the vendor, the customer database was likely accessed.
Here is the part that gets lost in the noise: the UpdraftPlus plugin itself was not compromised, and backups stored in your own Google Drive, Dropbox or S3 are untouched. For most people this is a “change your password” event. But there is one group that needs to act immediately, and for them it is serious.
Who this affects
| What you use | How urgent | What to do |
|---|---|---|
| UpdraftCentral (cloud) | High | Secure every connected site individually, today |
| UpdraftVault | Medium | Reconnect your sites, or backups silently stop |
| UpdraftClone | Medium | Distribute new keys, old ones are dead |
| A teamupdraft.com account | Low | Change your password, reset 2FA |
| Free UpdraftPlus, no account | None | Nothing |
| Self-hosted UpdraftCentral | None | Nothing |
What was exposed
According to TeamUpdraft, the database held:
- names, email addresses, billing addresses and order history
- passwords — hashed only, never in plain text
- two-factor authentication settings
- connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
Payment details are not stored; payments run through Stripe and PayPal.
That last bullet is the heart of the problem. An UpdraftCentral connection key can send commands to your site. In practice that is equivalent to an administrator account — it just does not authenticate through wp-login.php, it goes through an API. Whoever holds that key can install plugins, create users and change content on your site.
Using UpdraftCentral cloud? Do this today
TeamUpdraft is preparing an emergency UpdraftPlus release that will disconnect the old connections automatically. Do not wait for it. Until it ships and until it is installed on each site, the old key still works.
For every site, one at a time:
- Log in to that site’s own WordPress dashboard directly, not through UpdraftCentral.
- Go to Settings → UpdraftPlus → Advanced Tools → UpdraftCentral and delete the connection key.
- Under Users, look for any administrator account you do not recognise. Remove it.
- Under Plugins, go through the list including the Must-Use tab if you can see it. Remove anything you do not recognise.
- Change the passwords of every administrator on the site.
- If you find anything suspicious, consider restoring from a backup taken before 17 October.
- Only then reconnect the site to UpdraftCentral.
Step 4 matters more than it looks. Must-use plugins load automatically, cannot be deactivated from the dashboard and do not appear in the normal plugin list — which makes them a favourite hiding place for a backdoor.
The emergency release will only disconnect connections created before 22:00 BST on 18 October. If you reconnect a site using the steps above, the update will not disconnect it again.
UpdraftVault and UpdraftClone
UpdraftVault — every site has been disconnected, so nothing reaches the Vault until you reconnect it. Go to Settings → UpdraftPlus → Settings, click UpdraftVault under remote storage, then Connect under “Already got space?”, enter your email and your new password, and save. Run a manual backup afterwards to confirm it works.
This one is a quiet trap: backups simply stop and nothing announces it. The sooner you deal with it, the shorter the gap in your backup history.
UpdraftClone — every client key has been replaced. If you shared keys with your own clients, the new ones are in My Account → UpdraftClone → UpdraftClone Key Management and you need to send them out. Any clone using an old key will fail.
Expect phishing
The attackers have names, email addresses and order history. That is ideal material for a targeted scam — an email that knows your name, your licence and your purchase date is far more convincing than ordinary spam.
Expect messages along the lines of “your UpdraftPlus licence needs verification” or “reset your access here following the incident”. TeamUpdraft will never ask for your password or your keys. When you go to change your password, type teamupdraft.com into the address bar yourself — do not follow a link in an email, however legitimate it looks.
What the vendor has already done
For completeness: TeamUpdraft closed the access route, signed out every account, reissued UpdraftVault credentials, replaced every UpdraftClone key, rotated keys with payment providers, added monitoring, and reported the incident to the relevant authorities including the UK Information Commissioner’s Office.
The communication has been decent — a specific list of affected data, specific steps per product, and stated uncertainty where it exists. With incidents, that is unfortunately the exception rather than the rule.
The wider lesson
Beyond cleaning up, this case carries one general lesson that applies even if you have never used UpdraftPlus.
Centralised site-management tools concentrate risk. UpdraftCentral, ManageWP, MainWP and similar dashboards are genuinely useful — managing ten sites without one is painful. The price is that a key capable of commanding your site lives somewhere outside your site. When someone breaches the provider holding that key, they reach every site connected beneath it.
This is not an argument against centralised management. It is an argument for knowing who holds command-level access to your sites — and being able to list them before something happens rather than after. Most site owners cannot. The list includes management dashboards, backup services with write access, deployment tools, monitoring with write scope, agencies and former contractors.
The second lesson is about backups. The advice “restore from a backup taken before 17 October” only works if you have one, know where it is, and can actually deploy it. A backup you have never tested is not a backup — it is a hope.
Need help with this?
If you manage several sites and would rather not work through each one by hand, or you are not sure whether an attacker left anything behind, get in touch. We can audit users, plugins including must-use plugins, scheduled tasks and files, and compare them against a known-good state.
And if you do not know who currently holds access to your sites, that is a good reason for a review on its own — regardless of whether this particular incident touches you.