TeamUpdraft security incident: What customers need to know

Last updated: 29th October 2026 16:01 GMT. We may update this page as our investigation continues.

Update 29th Oct 16:01 GMT –

We have seen a small number of cases where a site was compromised during the original incident but showed no obvious sign at the time. On these sites, a plugin installed by the attacker was left in place and later used to create a new administrator account, after the site had already been disconnected from UpdraftCentral.

Disconnecting from UpdraftCentral stops access through UpdraftCentral, but it does not remove anything already installed on your site. If any of your sites have ever been connected to UpdraftCentral Cloud, please work through the checks in the “UpdraftCentral (cloud) users” section below on every one of them, including sites where you have seen nothing unusual. This applies to users of both the free and Premium versions of UpdraftPlus.

If you find anything you’re unsure about, contact our support team (see Support at the bottom of this page).

Update 22nd Oct 14:42BST –
Our support form was back up and available on our site late last night.

We’re asking our users to continue to be vigilant. It’s especially worth logging into UpdraftCentral via ‘My Account‘ and looking at the sites listed there.
If a site is listed that you didn’t knowingly connect since the 19th Oct, please check it for signs of compromise.

Here are some things to check on those sites:

• Any unusual/unexpected users (we’re seeing a pattern of unexpected ‘editor’ roles especially
• Any unrecognised plugins
• IPs you don’t recognise in the logs

If in doubt, please contact our customer support team.

Update 21st Oct 15:35BST –

We want to emphasise the importance for users of UpdraftPlus Premium to check your websites for signs of unusual activity. This could range from unexpected plugins to new admins. This is worth checking even if you’ve never used UpdraftCentral.

Secondly, in light of the ongoing issue affecting the PHP foundation – we’re taking our support form temporarily offline. Customers wishing to contact support can do so via the support forums. https://teamupdraft.com/support/ Choose between “premium support forums” and “ask for help (users of free plugins).

Update 21st Oct 10:23BST –

We just wanted to update you with a quick tl;dr list of established facts. As this is an ongoing incident, we don’t have all the answers yet – we’ll get them to you as soon as we do.

• We immediately took steps to lock down access and secure our site – there’s currently no evidence the attacker still has access
• We know the attacker used a compromised key to access our site.
• The speed of the exploits following the breach combined with the initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack.
• We have bought in an external leading cyber security firm to assist as an extra precaution (as well as our-in-house experts).
• We have contacted the relevant authorities (including the police) about this and are co-operating with them as they investigate.
• The update to UpdraftPlus pushed on the 19th (1.26.13 & 2.26.13) automatically disconnects user sites from UpdraftCentral by revoking connection keys.
• The attacker exploited the connection to users’ sites to create admin accounts, install malicious plugins etc – the extent of that is unknown so it’s important to check your sites for unexpected plugins, activity and users.

Update 20th Oct 16:25BST –

We’ve seen reports on other publications suggesting there is an ongoing attack. To be clear – the unauthorised access was resolved and an update to UpdraftPlus (1.26.13 and 2.26.13) published just after 10pm BST on the 19th revoked UpdraftCentral connection keys thus blocking any access across that vector. WordPress.org have pushed that out to all users so you don’t need to manually update (though it’s always worth checking you’re on the latest version).

It’s still important that users check over their sites for suspicious activities as listed in this blog post.

Original post

Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected.

This page explains what happened, what we have already done to protect you, and the steps to take for each of our products. Most users only need to change their password. If you use UpdraftCentral, please read that section and act on it today.

We believe our customer database was accessed. It holds:

• names, email addresses, billing addresses and order history
• account passwords, stored only in hashed (scrambled) form and never in plain text
• two-factor authentication settings
• connection keys for UpdraftCentral, UpdraftVault and UpdraftClone

We do not store any card details. All card payments are handled by Stripe and PayPal.

The UpdraftPlus plugin itself and its downloads were not affected. Backups sent to your own remote storage, such as Google Drive, Dropbox or Amazon S3, are not affected. However, if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution.

Self-hosted UpdraftCentral is not affected.

• Closed the access route, deployed a fix for the underlying weakness, and continued to strengthen the website’s security
• Signed out every teamupdraft.com account and reset login security across the site
• Released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which automatically disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, so the old keys stop working
• Disconnected every site from UpdraftVault and issued new credentials
• Replaced every UpdraftClone client key
• Rotated our keys with payment providers and other connected services
• Put additional monitoring in place, which we will keep running while we investigate
• Reported the incident to the Information Commissioner’s Office (ICO) and other relevant authorities

1. Change your teamupdraft.com password. Type teamupdraft.com into your browser rather than following a link.
2. If you use the same password anywhere else, change it there too.
3. If you use two-factor authentication on teamupdraft.com, reset it in My Account.
4. Be cautious of unexpected emails that claim to be from us. We will never ask for your password or keys.

Your UpdraftCentral connection keys can send commands to your connected sites, so please secure each site directly.

Important: Please complete the following checks on every website that has ever been connected to UpdraftCentral Cloud, even if you have already disconnected it or have not noticed anything unusual. This includes users of both the free and Premium versions of UpdraftPlus.

Updating UpdraftPlus and disconnecting from UpdraftCentral prevents access through the old connection keys, but it does not remove malicious plugins, administrator accounts or other changes an attacker may have already made.

For each site, follow the steps below.

1. Update UpdraftPlus and remove existing connection keys

1. Log in to the site’s own WordPress dashboard, not through UpdraftCentral.
2. Update UpdraftPlus to version 1.26.13 (free) or 2.26.13 (Premium) or later.
3. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
4. Click Manage existing keys and delete all existing connection keys.

UpdraftPlus 1.26.13 and 2.26.13 automatically revoke the affected connection keys. However, we recommend checking that no existing keys remain in your site’s database.

For advanced users: If you have access to WP-CLI, you can also remove the stored connection keys directly using the following command:

wp option delete updraft_central_localkeys

Removing a site from your UpdraftCentral dashboard alone is not sufficient. You must also check the site itself for anything the attacker may have installed.

2. Check for hidden or malicious plugins

We have identified malicious plugins that can hide themselves from the normal WordPress Plugins screen. This means that checking your installed plugins through the WordPress dashboard alone may not reveal everything.

First, go to Plugins in your WordPress dashboard, including the Must-Use tab if you can see it, and check for anything you don’t recognise.

Pay particular attention to plugins you did not install, including those using the following names:

• Site Health Cache
• Asset Forge 2
• Core Smith
• Data Engine Cc0
• Image Forge
• Quick Pack
• Seo Helper
• WP Forge

These are examples of names associated with suspicious plugins, not an exhaustive list. An unfamiliar plugin name does not automatically mean a plugin is malicious, but it should be investigated.

Check your website files directly

Because malicious plugins may be hidden from the WordPress dashboard, use SFTP, SSH or your hosting provider’s file manager to inspect the following directories:

wp-content/plugins/
wp-content/mu-plugins/

Look for unfamiliar plugin folders or files that you cannot account for.

For advanced users: If you have terminal access, you can search for a description identified in malicious plugin files using the following command:

grep -r "Small maintenance toolkit: keeps option storage tidy." wp-content/plugins/

Finding this description may indicate a suspicious plugin that requires further investigation. However, not finding it does not guarantee your site is clean.

Important: Do not delete suspicious plugins through the WordPress dashboard.

Some of the malicious plugins identified contain mechanisms designed to remove evidence when deleted through WordPress.

If you identify a malicious plugin, deactivate it first and remove the entire plugin folder directly using SFTP, SSH or your hosting provider’s file manager. If you are unsure whether a plugin is legitimate, contact our support team before removing it.

3. Check for unauthorised administrator and editor accounts

Go to Users in your WordPress dashboard and check for any administrator or editor accounts you don’t recognise.

However, some of the malicious plugins we have identified can hide unauthorised accounts from the normal WordPress Users screen.

For this reason, we recommend checking your user accounts independently of the WordPress dashboard.

For advanced users: If you have WP-CLI access, run the following commands to list administrator and editor accounts without loading plugins:

wp user list --role=administrator --skip-plugins

wp user list --role=editor --skip-plugins

Review the results carefully and investigate any accounts you do not recognise.

You can also inspect your WordPress database user tables directly. Look for unexpected accounts, including randomly generated usernames such as:

• data-ops43
• media-staff96

These are examples only. Suspicious accounts may use different names.

If you identify an unauthorised account, remove it after ensuring that any associated content is preserved or reassigned appropriately.

Also check your database for unexpected entries containing _sync_token, which have been associated with the attack. Investigate and remove confirmed malicious entries.

4. Reset passwords and invalidate existing login sessions

Once you have removed any malicious plugins and unauthorised accounts, take steps to prevent anyone who previously gained access from continuing to use an existing login session.

Reset your WordPress security keys

Changing your WordPress security keys and salts will invalidate existing login sessions and require users to log in again.

If you have WP-CLI access, you can do this using:

wp config shuffle-salts

If you do not have WP-CLI access, ask your hosting provider for assistance with updating your WordPress security keys.

Change your passwords

• Change the passwords for all legitimate administrator and editor accounts on your WordPress site.
• Log directly into teamupdraft.com, rather than following links in emails, and change your account password.
• If you use two-factor authentication on teamupdraft.com, reset it in My Account.
• If you use UpdraftVault or external remote storage connected through UpdraftCentral, reset the relevant credentials and reconnect those services.

5. Restore from a clean backup if necessary

If you find anything suspicious, consider restoring the site from a backup taken before 17 October.

Make sure the backup was created before the compromise and that any malicious plugins, accounts or other changes have been removed. Restoring a backup does not replace the need to revoke compromised keys and reset affected credentials.

If you are unsure whether your website has been compromised or need help completing these checks, please contact our support team.

6. Reconnect to UpdraftCentral

Once you have completed the security checks, removed any suspicious items and secured your website, you can reconnect the site to UpdraftCentral.

UpdraftPlus 1.26.13 and 2.26.13 automatically disconnect the old connections, so please update every site, including any you don’t manage day to day. If you have already reconnected a site using the steps above, the update will not disconnect it again.

All sites have been disconnected from UpdraftVault, so backups won’t reach Vault until you reconnect. For each site:

1. Log in to the site’s WordPress dashboard and go to Settings > UpdraftPlus > Settings.
2. Under remote storage, click UpdraftVault, then under “Already got space?” click Connect.
3. Enter your teamupdraft.com email and your new password, then click Connect.
4. Click Save Changes, then run a manual backup to confirm it’s working.

Every client key has been replaced and the old keys no longer work. If you’ve never created a client key, you don’t need to do anything. If you’ve shared keys with your own clients, copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and send them on. Any clone using an old key will fail.

You don’t need to take any action, though we always recommend keeping UpdraftPlus up to date. We recommend bookmarking this page for updates.

We know you trust us with your sites and backups, and we’re sorry for the concern this causes. Premium customers can contact us through the Premium Support form. Users of our free plugins can ask for help via “Ask for help (users of free plugins)” at https://teamupdraft.com/support/ . Everyone can find the latest updates on this page.