TeamUpdraft (maker of UpdraftPlus) says its customer database was accessed in a weekend breach of teamupdraft.com: names, emails, billing addresses, order history, hashed passwords, 2FA settings and UpdraftCentral, UpdraftVault and UpdraftClone connection keys; UpdraftPlus 1.26.12 / 2.26.12 revokes old UpdraftCentral cloud keys
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin (more than 4 million active installations on WordPress.org) and the UpdraftCentral, UpdraftVault and UpdraftClone services, said on 19 October 2026 that it found unauthorised access to the teamupdraft.com website over the weekend of 17–18 October. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored as hashes; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored (payments go through Stripe and PayPal). TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, backups sent to customers' own remote storage (such as Google Drive, Dropbox or Amazon S3) were not affected, and self-hosted UpdraftCentral is not affected. The main risk is the cloud UpdraftCentral connection keys, which can send commands to connected WordPress sites. In response the company closed the access route and fixed the underlying weakness, signed out every teamupdraft.com account, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and other connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities. It released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium), which automatically disconnect every UpdraftCentral connection made before 22:00 BST on 18 October (5:00 am Perth, 19 October) so the old keys stop working; 1.26.12 was published on WordPress.org on 19 October at 16:46 UTC (12:46 am Perth, 20 October) with the changelog entry 'Revokes UpdraftCentral Cloud keys created before the incident'. TeamUpdraft has not said how the attackers got in, how many accounts are affected, or whether any connected site was accessed through UpdraftCentral. No Australian impact has been reported, but Australian agencies, hosts and businesses that manage WordPress sites through cloud UpdraftCentral are in scope.
- Product
- TeamUpdraft customer accounts (teamupdraft.com) and cloud services: UpdraftCentral (cloud), UpdraftVault, UpdraftClone; UpdraftPlus WordPress backup plugin connection keys
- Versions
- UpdraftPlus before 1.26.12 (free) / 2.26.12 (Premium) still accept UpdraftCentral cloud connections made before 22:00 BST on 18 Oct 2026; self-hosted UpdraftCentral not affected
- Exploited in Australia?
- unknown
- Patch to
- Everyone with a teamupdraft.com account: change the password by typing teamupdraft.com into the browser (not via email links), change it anywhere it was reused, reset 2FA in My Account, and expect phishing that mentions the incident. Cloud UpdraftCentral users, today and for every site: log in to the site's own WordPress dashboard (not through UpdraftCentral), update UpdraftPlus to 1.26.12 (free) or 2.26.12 (Premium) or later, delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, remove administrator accounts and plugins (including Must-Use plugins) you do not recognise, change all administrator passwords, restore from a backup taken before 17 October if anything looks wrong, then reconnect. If a site was managed through UpdraftCentral, also re-authorise its remote storage and change storage access keys. UpdraftVault users must reconnect each site with the new password and run a manual backup; UpdraftClone users must hand out the new client keys.
Primary: TeamUpdraft — Security incident on teamupdraft.com: what happened, what we've done, and what you need to do (19 Oct 2026, updated 19:03 BST) · Vendor: WordPress.org — UpdraftPlus 1.26.12 (19 Oct 2026; revokes pre-incident UpdraftCentral Cloud keys)