--- title: "TeamUpdraft and UpdraftCentral key compromise" description: "TeamUpdraft confirmed unauthorized website access and misuse of UpdraftCentral connections to install malicious plugins." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-21" canonical_url: "https://www.ally.security/incidents/teamupdraft-updraftcentral-key-compromise-2026" markdown_url: "https://www.ally.security/incidents/teamupdraft-updraftcentral-key-compromise-2026.md" stix_url: "https://www.ally.security/incidents/teamupdraft-updraftcentral-key-compromise-2026/stix.json" --- # TeamUpdraft and UpdraftCentral key compromise Compromised connection keys enabled access to customer WordPress sites. Last modified Oct 21, 2026 · 2 sources ## Summary - **Environment:** TeamUpdraft customer systems and UpdraftCentral-connected WordPress sites - **Operational impact:** Unauthorized customer-site changes; connection keys revoked - **Financial impact:** No total incident cost established in the reviewed evidence ## What happened [TeamUpdraft](https://teamupdraft.com/) detected unauthorized website access during October 17–18, 2026. It later confirmed that attackers used customer-site connections to create administrator accounts and install malicious plugins. [1](#source-1) ## Impact TeamUpdraft believed its customer database was accessed. It held contact and billing details, order history, password hashes, two-factor settings and service connection keys. The downstream extent remains unknown. [1](#source-1) The vendor said plugin downloads and self-hosted UpdraftCentral were unaffected. [1](#source-1) ## Timeline ### October 19, 2026 — Disclosure and key revocation TeamUpdraft published its [notice](https://teamupdraft.com/blog/security-incident-october-2026/) and released UpdraftPlus 1.26.13 and 2.26.13 to revoke connections. [1](#source-1) ### October 21, 2026 — Customer-site misuse confirmed Premium users were urged to check sites even without knowingly using UpdraftCentral. [1](#source-1) ### October 21, 2026 — Briefing updated This briefing was last reviewed and updated on October 21, 2026. ## Threat Group & Attack Vector The vendor identified a compromised key as its entry route. [1](#source-1) [Patchstack’s analysis](https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/) described valid signed commands delivering backdoors. The resulting privileged accounts could survive removal of the malicious plugin. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response TeamUpdraft closed access, rotated keys, signed out accounts and notified authorities. Its dated updates specify the .13 releases; older .12 instructions remain lower on the page. The vendor still urges site review after disconnection. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### TeamUpdraft security incident: What customers need to know official · TeamUpdraft · Oct 19, 2026 ### Stolen UpdraftCentral Keys Are Backdooring WordPress Sites research · Patchstack · Oct 19, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Disclosure and key-revocation release: 2026-10-19 2. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft said plugin downloads, self-hosted UpdraftCentral and backups in customers’ own remote storage were not affected; connected-site compromise still required separate review. 3. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft confirmed that an attacker abused connections to customer websites to create administrator accounts and install malicious plugins; the extent remained unknown. 4. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: Customer-site misuse and expanded review guidance confirmed 5. **Occurred At · 100% confidence · current** Customer-site misuse and expanded review guidance confirmed: 2026-10-21 6. **Affected Organization · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft 7. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: Patchstack analyzed malicious plugins delivered through valid signed UpdraftCentral commands and described privileged backdoor accounts that could survive plugin removal. 8. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft said it closed the entry route, signed out accounts, rotated keys and reported the incident to authorities, including the ICO and police. 9. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: The October 21 15:35 BST update urged Premium users to review their sites even if they had never knowingly used UpdraftCentral. 10. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft believed its customer database was accessed; it held names, contact and billing details, order history, password hashes, two-factor settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. 11. **Disclosed At · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: 2026-10-19 12. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: Disclosure and key-revocation release 13. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: The October 20 update said UpdraftPlus 1.26.13 and 2.26.13, released after 22:00 BST on October 19, revoked UpdraftCentral connection keys. 14. **Resulted In · 100% confidence · current** TeamUpdraft and UpdraftCentral key compromise: TeamUpdraft detected unauthorized access to its website during October 17–18 and said the attacker used a compromised key.