Short answer
TeamUpdraft says it found unauthorized access to teamupdraft.com over the weekend of 17 and 18 October 2026 and believes the customer database was reached. Stolen UpdraftCentral keys were then used to install backdoor plugins and administrator accounts on WordPress sites.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | TeamUpdraft (UpdraftPlus) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | WordPress software |
| Country | United Kingdom |
| Detected | 2026-10-18 |
| Disclosed | 2026-10-19 |
| People or records affected | Not stated by TeamUpdraft. BleepingComputer estimated roughly 400,000 sites could hold an UpdraftCentral or Migrator key |
What data was exposed
- Customer names, email addresses, billing addresses and order history
- Account passwords stored as hashes, and two-factor authentication settings
- Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
What happened
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said it identified unauthorized access to teamupdraft.com over the weekend of 17 and 18 October 2026. It closed the access route, signed out all accounts and replaced potentially affected keys and credentials. BleepingComputer reported the case on 20 October.
TeamUpdraft says the attacker used a compromised key and that the speed of exploitation suggests AI was used. That is the company’s inference, not a confirmed attribution. It has not named the attacker.
The data and the keys
The exposed customer database held names, email and billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The plugin files, downloads and backups in users’ own remote storage were not affected, according to TeamUpdraft, and self-hosted UpdraftCentral is not affected.
The connection keys are the serious part. BleepingComputer reported that Patchstack saw attacks begin on 18 October at 15:32 UTC, with at least 99 distinct malicious plugins disguised as maintenance tools. The security firm Nethemba, quoted in the same article, said attackers signed commands with valid private dashboard keys and that its patched sites were targeted without any weakness in its own configuration.
Scale
TeamUpdraft has not said how many sites were affected. BleepingComputer cited more than 4 million UpdraftPlus downloads and an estimated 10% of sites holding an UpdraftCentral or Migrator key, or about 400,000 sites. That is the outlet’s estimate of exposure, not a count of compromised sites.
Response and later findings
TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 on 19 October, which disconnects older UpdraftCentral connections, and it disconnected all UpdraftVault sites and replaced every UpdraftClone client key. It engaged an external security firm and reported the incident to the UK Information Commissioner’s Office and other authorities. On 29 October it said it had found sites where an attacker-installed plugin was left behind and later used to create a new administrator account.
What to do
Follow the actions above and check files and users directly. TeamUpdraft listed plugin names reported in the attacks, such as Site Health Cache and Core Smith, and suspicious administrator names. See our data breach checklist, the guide to account takeover and the guide to phishing messages, since fake TeamUpdraft emails are a likely follow-on.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as TeamUpdraft or UpdraftPlus that ask you to reset a password or reconnect a site through a link.
- Fake plugin 'security updates' or hidden admin accounts used to redirect visitors, steal customer data or sell access to your site.
- Credential stuffing against other services if you reused your TeamUpdraft password.
What to do if you are affected
- 01Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later on every site.
- 02In UpdraftPlus, open Advanced Tools, then UpdraftCentral, then Manage existing keys, and delete all keys.
- 03Look in the plugins and mu-plugins folders and in your user list for items you do not recognize, because some hide from the dashboard. Deactivate and remove suspicious plugins from the folder directly.
- 04Change WordPress salts, reset every legitimate admin and editor password, and re-authorize remote storage.
- 05Change your TeamUpdraft password by typing the address yourself, change it wherever you reused it, and reset two-factor authentication.
Frequently asked questions
Was my card data stolen?
TeamUpdraft says it does not store card details because Stripe and PayPal handle payments. The data it lists is contact and billing details, order history, hashed passwords, two-factor settings and connection keys.
Are free UpdraftPlus users affected?
TeamUpdraft says free users without a TeamUpdraft account need only keep the plugin updated, unless they ever connected to UpdraftCentral Cloud, in which case they should follow the full steps.
Is deleting the plugin enough?
No. TeamUpdraft says checking only the UpdraftCentral dashboard is not enough. Attacker-installed plugins can survive disconnection, so inspect the site files and users directly.
Why did the first update not fix it?
BleepingComputer reported that release 1.26.12 and 2.26.12 was meant to remove UpdraftCentral Cloud keys but a bug stopped it. The 1.26.13 and 2.26.13 releases on 19 October did revoke them.
Sources
- Security incident, October 2026, TeamUpdraft, 2026-10-19
- Stolen UpdraftCentral keys used to backdoor WordPress sites, BleepingComputer, 2026-10-20
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.