{"id":19112,"date":"2026-10-28T05:21:49","date_gmt":"2026-10-28T05:21:49","guid":{"rendered":"https:\/\/trejka.com\/?p=19112"},"modified":"2026-10-28T05:22:35","modified_gmt":"2026-10-28T05:22:35","slug":"the-updraftplus-incident-what-weve-done-for-your-website","status":"publish","type":"post","link":"https:\/\/trejka.com\/en\/incydent-updraftplus-co-zrobilismy-dla-twojej-strony\/","title":{"rendered":"The UpdraftPlus incident \u2014 what we\u2019ve done for your website"},"content":{"rendered":"<p data-lfile-container=\"e123bc14-fb93-4c52-9b2e-f33425680c51\" data-pm-slice=\"1 1 []\">In October 2026, the servers of the company behind UpdraftPlus, a popular WordPress backup plugin, were hacked. We checked all the websites under our care, closed the entry point the attacker might have used, and updated the plugin to the patched version. Your backups are safe, and in most cases you do not need to do anything.<\/p>\n<p data-lfile-container=\"e123bc14-fb93-4c52-9b2e-f33425680c51\" data-pm-slice=\"1 1 []\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19113\" src=\"https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft.jpeg\" alt=\"\" width=\"1160\" height=\"376\" srcset=\"https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft.jpeg 1160w, https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft-300x97.jpeg 300w, https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft-1024x332.jpeg 1024w, https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft-768x249.jpeg 768w, https:\/\/trejka.com\/wp-content\/uploads\/2026\/10\/updraft-18x6.jpeg 18w\" sizes=\"auto, (max-width: 1160px) 100vw, 1160px\" \/><\/p>\n<ul>\n<li data-lfile-container=\"e123bc14-fb93-4c52-9b2e-f33425680c51\" data-pm-slice=\"1 1 []\">The photo is from&nbsp;<a href=\"https:\/\/pl.wordpress.org\/plugins\/updraftplus\/\" target=\"_blank\" rel=\"noopener\">WordPress.org<\/a><\/li>\n<\/ul>\n<h2 id=\"co-si\u0119-sta\u0142o\">What happened?<\/h2>\n<p>UpdraftPlus backs up WordPress sites. It also offers UpdraftCentral, a dashboard for remotely managing multiple sites. Each site connected to this dashboard has a unique key that allows you to issue commands to it.<\/p>\n<p>On 17\u201318 October, someone hacked into the teamupdraft.com server and stole, amongst other things, these keys. Between 18 and 19 October, they used them to install a malicious plugin on websites, masquerading as a site maintenance tool. The plugin created a hidden account with administrator privileges.<\/p>\n<p>Websites that had an UpdraftCentral key were at risk. Even a website where nobody was knowingly using UpdraftCentral could have received such a key: simply connecting the plugin to a teamupdraft.com account was enough. On 19 October, the developer released a patch (UpdraftPlus 1.26.13 and 2.26.13 Premium) which invalidates the old keys.<\/p>\n<p>No backups stored in external storage facilities, nor any data from those facilities, have been compromised. The developer emphasises that the plugin itself and its downloadable files have not been altered.<\/p>\n<h2 id=\"co-zrobili\u015bmy\">What we\u2019ve done<\/h2>\n<p>Our website management system allows us to check and edit all our clients\u2019 websites at the same time. We didn\u2019t have to log in to each one individually.<\/p>\n<ol>\n<li><strong>We checked every page.<\/strong> We looked for signs of the attack described by the manufacturer and security firms: a malicious plugin, suspicious accounts, entries in the UpdraftPlus log and unnecessary UpdraftCentral keys.<\/li>\n<li><strong>We have removed the UpdraftCentral keys<\/strong> wherever they\u2019ve appeared. We don\u2019t use this panel, so you won\u2019t miss out on anything.<\/li>\n<li><strong>We have updated UpdraftPlus<\/strong> to the corrected version.<\/li>\n<li><strong>We had a procedure in place for pages with suspicious traces:<\/strong> isolating malicious code without executing it, removing hidden accounts, logging out all users and, if necessary, restoring the website from a pre-attack backup. We investigate individual reports on a case-by-case basis. If they relate to your website, we will contact you directly.<\/li>\n<li><strong>We have secured the backups taken prior to the incident.<\/strong> At the same time, our backup storage provider experienced an outage in one region, so we have temporarily suspended automatic UpdraftPlus backups. We are moving them to a different location and protecting older backups from being automatically deleted.<\/li>\n<li><strong>I have changed the password for my TREJKA account on teamupdraft.com<\/strong> and I reconfigured two-factor authentication, as the 2FA settings had also been leaked from the manufacturer\u2019s database.<\/li>\n<\/ol>\n<h2 id=\"czy-musisz-co\u015b-zrobi\u0107\">Do you need to do anything?<\/h2>\n<p>In most cases, nothing. We\u2019ve taken care of everything to do with your website for you.<\/p>\n<p>Exceptions:<\/p>\n<ul>\n<li><strong>Do you have your own account on teamupdraft.com?<\/strong> (e.g. you purchased the UpdraftPlus licence yourself). Change your password by typing teamupdraft.com into your browser manually. Also change it wherever you have used the same password, and set up two-factor authentication again.<\/li>\n<li><strong>Have you noticed an account in your WordPress dashboard that you don\u2019t recognise,<\/strong> or a plugin that nobody has installed. Don\u2019t delete anything yourself \u2013 just let us know. Deleting such a plugin from the dashboard may cover your tracks.<\/li>\n<\/ul>\n<p><strong>Be careful with emails.<\/strong> Following such incidents, fake messages \u201efrom the developer\u201d start to appear. Neither UpdraftPlus nor we will ever ask you for your password or licence keys by email.<\/p>\n<h2 id=\"co-zmieniamy-na-przysz\u0142o\u015b\u0107\">What changes are we making for the future?<\/h2>\n<p>This incident has shown that the threat may come from the provider of a trusted tool, rather than from the website itself. Therefore:<\/p>\n<ul>\n<li><strong>Separate keys for the storage areas for each client.<\/strong> A problem on one page will not affect the copies on other pages.<\/li>\n<li><strong>Fewer connections to external panels.<\/strong> Every additional remote management panel is another door. We only keep the ones we actually use.<\/li>\n<li><strong>A rapid response for the entire fleet.<\/strong> The tools we\u2019ve developed for checking and repairing issues during this incident will remain in use. Should a similar incident occur, we\u2019ll be able to check all sites within a few hours, rather than a few days.<\/li>\n<\/ul>\n<h2 id=\"masz-pytania\">Do you have any questions?<\/h2>\n<p>Call us on: +48 695 423 811 or email us at: <a href=\"mailto:bartek@trejka.com\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">bartek@trejka.com<\/a>. We\u2019d be happy to have a look at your website with you.<\/p>","protected":false},"excerpt":{"rendered":"<p>W&nbsp;pa\u017adzierniku 2026&nbsp;roku w\u0142amano si\u0119 na&nbsp;serwery firmy, kt\u00f3ra&nbsp;tworzy UpdraftPlus, popularn\u0105 wtyczk\u0119 do&nbsp;kopii zapasowych WordPressa. Sprawdzili\u015bmy wszystkie strony pod&nbsp;nasz\u0105 opiek\u0105, zamkn\u0119li\u015bmy drog\u0119, kt\u00f3r\u0105 m\u00f3g\u0142 wej\u015b\u0107 atakuj\u0105cy, i&nbsp;zaktualizowali\u015bmy wtyczk\u0119 do&nbsp;wersji z&nbsp;poprawk\u0105. Twoje kopie zapasowe s\u0105 bezpieczne, a&nbsp;w&nbsp;wi\u0119kszo\u015bci przypadk\u00f3w nie&nbsp;musisz nic robi\u0107. zdj\u0119ie pochodzi z&nbsp;WordPress.org Co&nbsp;si\u0119 sta\u0142o UpdraftPlus robi kopie zapasowe stron WordPress. Ma&nbsp;te\u017c us\u0142ug\u0119 UpdraftCentral, czyli panel do&nbsp;zdalnego [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":19111,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-19112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"acf":[],"_links":{"self":[{"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/posts\/19112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/comments?post=19112"}],"version-history":[{"count":2,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/posts\/19112\/revisions"}],"predecessor-version":[{"id":19115,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/posts\/19112\/revisions\/19115"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/media\/19111"}],"wp:attachment":[{"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/media?parent=19112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/categories?post=19112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trejka.com\/en\/wp-json\/wp\/v2\/tags?post=19112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}