TeamUpdraft security incident: What customers need to know

Last updated: 19 October 2026 16:43pm. We may update this page as our investigation continues.

Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected.

This page explains what happened, what we have already done to protect you, and the steps to take for each of our products. Most users only need to change their password. If you use UpdraftCentral, please read that section and act on it today.

We believe our customer database was accessed. It holds:

• names, email addresses, billing addresses and order history
• account passwords, stored only in hashed (scrambled) form and never in plain text
• two-factor authentication settings
• connection keys for UpdraftCentral, UpdraftVault and UpdraftClone

We never store payment details – payments are handled by Stripe and PayPal.

The UpdraftPlus plugin itself and its downloads were not affected. Backups sent to your own remote storage, such as Google Drive, Dropbox or Amazon S3, are not affected. Self-hosted UpdraftCentral is not affected.

• Closed the access route and secured the website
• Signed out every teamupdraft.com account and reset login security across the site
• Started work on an emergency UpdraftPlus release that will automatically disconnect every UpdraftCentral connection made before 22:00 BST on 18 October, so the old keys stop working on every site. This will be released ASAP
• Disconnected every site from UpdraftVault and issued new credentials
• Replaced every UpdraftClone client key
• Rotated our keys with payment providers and other connected services
• Put additional monitoring in place, which we will keep running while we investigate
• Reported the incident to the relevant authorities, including the Information Commissioner’s Office (ICO), and are meeting all our legal and regulatory obligations

1. Change your teamupdraft.com password. Type teamupdraft.com into your browser rather than following a link.
2. If you use the same password anywhere else, change it there too.
3. If you use two-factor authentication on teamupdraft.com, reset it in My Account.
4. Be cautious of unexpected emails that claim to be from us. We will never ask for your password or keys.

Your UpdraftCentral connection keys can send commands to your connected sites, so please secure each site directly rather than waiting for our update. For each site:

1. Log in to the site’s own WordPress dashboard, not through UpdraftCentral.
2. Disconnect it from UpdraftCentral: go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key.
3. Go to Users and check for any administrator accounts you don’t recognise. Remove them.
4. Go to Plugins, including the Must-Use tab if you can see it, and check for anything you don’t recognise. Remove it.
5. Change the passwords for all administrator accounts on the site.
6. If you find anything suspicious, consider restoring the site from a backup taken before 17 October.
7. Reconnect the site to UpdraftCentral.

We are also preparing an emergency UpdraftPlus release that will disconnect the old connections automatically. If you reconnect a site using the steps above, the update will not disconnect it again. We will update this page as soon as the release is available.

All sites have been disconnected from UpdraftVault, so backups won’t reach Vault until you reconnect. For each site:

1. Log in to the site’s WordPress dashboard and go to Settings > UpdraftPlus > Settings.
2. Under remote storage, click UpdraftVault, then under “Already got space?” click Connect.
3. Enter your teamupdraft.com email and your new password, then click Connect.
4. Click Save Changes, then run a manual backup to confirm it’s working.

Every client key has been replaced and the old keys no longer work. If you’ve never created a client key, you don’t need to do anything. If you’ve shared keys with your own clients, copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and send them on. Any clone using an old key will fail.

You don’t need to take any action. We recommend bookmarking this page for updates.

We know you trust us with your sites and backups, and we’re sorry for the concern this causes. Premium customers can contact us through the Premium Support form. Everyone else can find updates on this page.