TeamUpdraft confirmed that attackers breached its website in October 2026 and accessed a customer database containing names, emails, billing details, hashed passwords, 2FA settings, and UpdraftCentral connection keys. Those keys were then used to install backdoor plugins on connected WordPress sites. Affected users should immediately change their TeamUpdraft password and reset two-factor authentication.
| Company | TeamUpdraft |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Names, Email Addresses, Billing Addresses, Order History, Hashed Passwords, Two-Factor Authentication Settings, Connection Keys |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unauthorized Network Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the TeamUpdraft Data Breach?
TeamUpdraft, the company behind the widely used UpdraftPlus WordPress backup plugin, confirmed that its own website suffered a security incident. The company said unauthorized access to its network occurred in October 2026. As a result, attackers may have reached customer account data stored on the teamupdraft.com platform.
According to TeamUpdraft, the intrusion happened over a single weekend in mid-October. The company stated that its team responded quickly once it noticed the activity. In response, TeamUpdraft said it cut off the attacker’s access, logged out every account, and replaced keys and credentials that could have been exposed.
Beyond the initial access, the attackers reportedly used stolen UpdraftCentral connection keys to send commands to connected WordPress sites. This allowed them to install rogue plugins that functioned as backdoors. Outside security researchers independently observed this activity happening in the wild, which helped confirm the scope of the incident.
Following discovery, TeamUpdraft said it investigated the root cause and deployed a fix. The company also released updated versions of its plugin to automatically cut off older, potentially compromised UpdraftCentral connections. This forensic response points to a serious but contained compromise of the vendor’s own infrastructure, rather than a flaw in the plugin’s core code shipped to every user.
Who was affected?
The breach affects individuals who hold a teamupdraft.com account, including customers who purchased UpdraftPlus, UpdraftCentral cloud services, UpdraftVault backup storage, or UpdraftClone. Because UpdraftPlus has more than four million active installations, the pool of potentially affected account holders could be large. However, the exact number of affected individuals has not been publicly disclosed.
In addition to direct TeamUpdraft account holders, website owners whose WordPress sites were connected to the cloud-hosted UpdraftCentral service at the time of the incident may also be affected. This means the impact reaches beyond just the people who created teamupdraft.com accounts. It potentially touches any WordPress site administrator relying on that specific cloud connection feature.
TeamUpdraft noted that self-hosted versions of UpdraftCentral and the core UpdraftPlus plugin itself were not affected by this incident. As a result, the population most at risk is narrower than the plugin’s full user base. Still, anyone using the cloud-based remote management service should assume they could be included.
What Information Was Potentially Exposed?
TeamUpdraft stated that attackers are believed to have accessed its customer database. The company described specific categories of information contained in that database. Below is what TeamUpdraft confirmed was present in the exposed system.
- Names, email addresses, billing addresses, and order history
- Account passwords, stored only in hashed form
- Two-factor authentication (2FA) settings
- Connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone
TeamUpdraft said the database does not store financial information, since payment processing is handled by third-party providers. This limits the risk of direct financial account fraud from this particular database. However, the exposure of names and email addresses still creates a real risk of targeted phishing campaigns against affected customers.
Because passwords were hashed rather than stored in plain text, immediate account takeover risk is reduced, but not eliminated. For example, attackers sometimes attempt to crack weaker hashed passwords offline over time. In addition, anyone who reused their TeamUpdraft password on other websites faces a higher risk if that password is ever recovered.
The exposure of UpdraftCentral, UpdraftVault, and UpdraftClone connection keys carries its own distinct danger. These keys can be used to send remote commands directly to connected WordPress websites. As demonstrated in this incident, that access let attackers install backdoor plugins and create hidden administrator accounts on affected sites.
What is the company doing?
TeamUpdraft said it acted immediately after detecting the intrusion. The company reported that it closed the unauthorized access route, signed every account out of its system, and reset login security sitewide. It also rotated its own keys with payment providers and other connected services to limit further risk.
Furthermore, TeamUpdraft disconnected every site from UpdraftVault and issued new credentials to customers. It also replaced every UpdraftClone client key still in use. The company released updated UpdraftPlus versions, 1.26.13 and 2.26.13, designed to automatically sever old UpdraftCentral connections made before the cutoff time identified during the investigation.
As part of its ongoing response, TeamUpdraft said it implemented additional monitoring to watch for further suspicious activity. The company also reported the incident to the U.K. Information Commissioner’s Office and other relevant authorities. Because the attackers used stolen keys to actively plant backdoors on customer websites, TeamUpdraft provided detailed cleanup instructions for affected site owners to follow right away.
What Should Affected Individuals Do?
Change Your TeamUpdraft Password Immediately
If you hold a teamupdraft.com account, change your password right away. This matters even though TeamUpdraft stored passwords only in hashed form, because hashed passwords can sometimes still be cracked later.
In addition, update your password anywhere else you may have reused it. Password reuse is one of the most common ways a single breach turns into multiple account compromises. Choose a unique, strong password for every important account going forward.
Reset Two-Factor Authentication Settings
Because 2FA settings were among the exposed data, affected users should reset their two-factor authentication configuration. This helps ensure that any previously stored settings can no longer be used by someone else.
Moreover, consider using an authenticator app rather than SMS-based codes where possible. Authenticator apps are generally harder for attackers to intercept. This extra step adds meaningful protection to your account going forward.
Secure Your WordPress Site If You Used UpdraftCentral
If your WordPress site was connected to the cloud-hosted UpdraftCentral service, treat it as potentially compromised. Log in directly through your WordPress dashboard rather than through UpdraftCentral. Then check your list of administrator accounts and plugins for anything unfamiliar.
If you find anything suspicious, remove it immediately and change every administrator password on the site. For added safety, consider restoring your site from a backup taken before the incident window. Afterward, reconnect carefully using new, updated keys.
Watch for Phishing Attempts
Since your name and email address may have been exposed, be cautious of unexpected messages claiming to come from TeamUpdraft. Scammers often use breach data to craft convincing, targeted phishing emails.
Therefore, avoid clicking links or downloading attachments from unsolicited messages. Instead, go directly to the official TeamUpdraft website or your WordPress dashboard to verify any account-related claims. When in doubt, contact support through verified channels only.
Monitor Your Accounts and Consider Professional Guidance
Even though financial data was not stored in the exposed database, it is still wise to monitor your other online accounts for unusual activity. This is especially true if you reused your TeamUpdraft password elsewhere.
If you are concerned about how this breach may affect you personally, consider speaking with a data breach attorney for a free case evaluation. They can help you understand your options and whether you may be eligible for compensation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.