UpdraftPlus Breach: Check Every Site Ever Linked to UpdraftCentral

TeamUpdraft, the company behind UpdraftPlus, now says some sites were hacked through its UpdraftCentral service without any visible signs.

So check every site you ever connected to UpdraftCentral Cloud, whatever date you linked it, because the first fix only cut keys made before a set time on October 18.

Use UpdraftPlus?

Then the update alone won’t clean a site that was already hit, since a hidden plugin stays put long after the key that let it in is gone.

What happened

TeamUpdraft spotted an intruder on teamupdraft.com over the weekend of October 17 and 18, says TeamUpdraft’s incident page. The company says customer account data was exposed.

It lists these as exposed:

• names, email and billing addresses, order history
• account passwords, stored as hashes
• two-factor settings
• connection keys for UpdraftCentral, UpdraftVault and UpdraftClone

Those keys are the dangerous part. UpdraftCentral lets you run many WordPress sites from one dashboard, so a stolen key can send commands straight to your site.

That’s what happened next.

BleepingComputer’s report on the attacks cites Patchstack, which saw attacks start on October 18 at 15:32 UTC.

Patchstack logged at least 99 backdoor plugins, with dull names like “Site Health Cache” so you’d scroll past them.

BleepingComputer also puts the possible exposure at around 400,000 sites, since about one in ten UpdraftPlus sites has an UpdraftCentral or Migrator key that could be on the list.

What the fix covers

UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) came out late on October 19 and cut your connections made before 13:07 BST on October 18.

If you’re on 1.26.12, update again. That first try had a bug that left Cloud keys in place, per BleepingComputer.

But it won’t remove backdoor plugins or accounts an attacker already added.

Then on October 29 TeamUpdraft warned that some sites were hit with nothing to see, so a site that looks normal today can still carry a hidden account or plugin.

TeamUpdraft says these were safe:

• card details, which Stripe and PayPal handle
• the plugin and its downloads
• backups in your own remote storage
• self-hosted UpdraftCentral

Why it matters

A backup plugin is the one tool you trust to bring a site back after a hack, and this time the service around it became the way in for whoever held the keys.

Still, if you ever connected a site, I’d treat it as suspect until you’ve checked it. Here are the steps from TeamUpdraft and BleepingComputer, shortened:

1. Update UpdraftPlus, then delete every key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
2. Look for plugins you don’t recognise. TeamUpdraft says some malicious plugins hide from the normal Plugins screen, so checking that list isn’t enough.
3. Check your Users list for unexpected users, especially editors, since TeamUpdraft says it is seeing a pattern of unexpected editor roles.
4. If you confirm a compromise, change your TeamUpdraft account password and revoke all sessions.
5. If compromise is confirmed, restore the site from a clean backup, as BleepingComputer recommends.

Have a teamupdraft.com account? Change that password, and any other place you reused it.

Of course, the free plugin on its own isn’t the problem.

If you run client sites through UpdraftCentral, I’d check every one of them this week, starting with the busiest shop, before a client finds a stranger sitting in their Users list.

Common Questions

Does updating UpdraftPlus to 1.26.13 remove the backdoor?

No. The update revokes old UpdraftCentral connection keys, but it won’t remove backdoor plugins or accounts an attacker already added. You have to check plugins and users by hand.

Which UpdraftPlus users need to act after the TeamUpdraft breach?

Every site you ever connected to UpdraftCentral Cloud needs checking, free or Premium, and every teamupdraft.com account holder should change their password. Premium users should check their sites even if they’ve never used UpdraftCentral.

Were UpdraftPlus backups stolen in the October 2026 breach?

TeamUpdraft says backups stored in your own remote storage, such as Google Drive, Dropbox or Amazon S3, were not affected. It still suggests changing storage keys if a site was reached through UpdraftCentral.