In October 2026, the servers of the company behind UpdraftPlus, a popular WordPress backup plugin, were hacked. We checked all the websites under our care, closed the entry point the attacker might have used, and updated the plugin to the patched version. Your backups are safe, and in most cases you do not need to do anything.
- The photo is from WordPress.org
What happened?
UpdraftPlus backs up WordPress sites. It also offers UpdraftCentral, a dashboard for remotely managing multiple sites. Each site connected to this dashboard has a unique key that allows you to issue commands to it.
On 17–18 October, someone hacked into the teamupdraft.com server and stole, amongst other things, these keys. Between 18 and 19 October, they used them to install a malicious plugin on websites, masquerading as a site maintenance tool. The plugin created a hidden account with administrator privileges.
Websites that had an UpdraftCentral key were at risk. Even a website where nobody was knowingly using UpdraftCentral could have received such a key: simply connecting the plugin to a teamupdraft.com account was enough. On 19 October, the developer released a patch (UpdraftPlus 1.26.13 and 2.26.13 Premium) which invalidates the old keys.
No backups stored in external storage facilities, nor any data from those facilities, have been compromised. The developer emphasises that the plugin itself and its downloadable files have not been altered.
What we’ve done
Our website management system allows us to check and edit all our clients’ websites at the same time. We didn’t have to log in to each one individually.
- We checked every page. We looked for signs of the attack described by the manufacturer and security firms: a malicious plugin, suspicious accounts, entries in the UpdraftPlus log and unnecessary UpdraftCentral keys.
- We have removed the UpdraftCentral keys wherever they’ve appeared. We don’t use this panel, so you won’t miss out on anything.
- We have updated UpdraftPlus to the corrected version.
- We had a procedure in place for pages with suspicious traces: isolating malicious code without executing it, removing hidden accounts, logging out all users and, if necessary, restoring the website from a pre-attack backup. We investigate individual reports on a case-by-case basis. If they relate to your website, we will contact you directly.
- We have secured the backups taken prior to the incident. At the same time, our backup storage provider experienced an outage in one region, so we have temporarily suspended automatic UpdraftPlus backups. We are moving them to a different location and protecting older backups from being automatically deleted.
- I have changed the password for my TREJKA account on teamupdraft.com and I reconfigured two-factor authentication, as the 2FA settings had also been leaked from the manufacturer’s database.
Do you need to do anything?
In most cases, nothing. We’ve taken care of everything to do with your website for you.
Exceptions:
- Do you have your own account on teamupdraft.com? (e.g. you purchased the UpdraftPlus licence yourself). Change your password by typing teamupdraft.com into your browser manually. Also change it wherever you have used the same password, and set up two-factor authentication again.
- Have you noticed an account in your WordPress dashboard that you don’t recognise, or a plugin that nobody has installed. Don’t delete anything yourself – just let us know. Deleting such a plugin from the dashboard may cover your tracks.
Be careful with emails. Following such incidents, fake messages „from the developer” start to appear. Neither UpdraftPlus nor we will ever ask you for your password or licence keys by email.
What changes are we making for the future?
This incident has shown that the threat may come from the provider of a trusted tool, rather than from the website itself. Therefore:
- Separate keys for the storage areas for each client. A problem on one page will not affect the copies on other pages.
- Fewer connections to external panels. Every additional remote management panel is another door. We only keep the ones we actually use.
- A rapid response for the entire fleet. The tools we’ve developed for checking and repairing issues during this incident will remain in use. Should a similar incident occur, we’ll be able to check all sites within a few hours, rather than a few days.
Do you have any questions?
Call us on: +48 695 423 811 or email us at: [email protected]. We’d be happy to have a look at your website with you.