TeamUpdraft website breached, potentially exposing customer records and service connection keys.
Core UpdraftPlus plugin and self-hosted setups unaffected; updates released to disconnect legacy remote connections.
TeamUpdraft develops UpdraftPlus, a popular backup tool for WordPress websites with over four million active installations, and also operates remote monitoring services.
What evidence fell into the wrong hands?
The exposed customer database included names, email addresses, billing addresses, order history, passwords in encrypted form, two-step authentication settings, and login keys.
The company clarified that customer financial information is not stored on its systems, as it is managed directly by Stripe and PayPal. The UpdraftPlus plugin itself, locally managed versions, and backups sent to user storage were also not affected.
READ ALSO
India's largest bank confirms leak of thousands of customer personal records
The action of the attacks
Security researchers observed that the perpetrators used valid connection keys to send commands and secretly install add-ons on October 18 and 19, 2026. Experts identified the dangerous program as acting as a backdoor that intercepts website requests and creates unauthorized accounts.
What did the company do?
TeamUpdraft released versions 1.26.13 for the free version and 2.26.13 for Premium, which automatically disconnect all connections made before 10pm on October 18, 2026. In addition, the company reported the incident to the UK's data protection authority.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
