{
  "type": "bundle",
  "id": "bundle--91901fd7-47c8-5779-8ff4-4abb8718f561",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--670cc84f-9f88-58bc-85ae-fba1764566f2",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "org:80c10552-874c-4f2c-bfcb-8f57747e14e5",
      "name": "TeamUpdraft",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--944ed4b2-b3fc-55e6-8b2d-ca784a35f58d",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "inc:360c9e61-5e13-4947-8a1a-18cac8c71453",
      "name": "TeamUpdraft and UpdraftCentral key compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c46d7fd3-883d-5a14-8952-af3b14698a2b",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "brh:95492884-a28a-48f7-907c-3ab7e62e9a92",
      "name": "TeamUpdraft and UpdraftCentral key compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13da8d9b-5c42-5d05-8218-af5c2758210f",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:40fb1ba4-60c8-4212-88d9-acb2916d2270",
      "relationship_type": "resulted-in",
      "source_ref": "incident--944ed4b2-b3fc-55e6-8b2d-ca784a35f58d",
      "target_ref": "x-ally-event--8d104ff4-a3ae-53ee-8af4-faa0fcc69365",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:7d9c3beb-0ece-42dc-be53-5972133842a8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c0ed8c9-8a4d-56a7-870c-6e712bb01162",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:94bdf126-67a3-4ee2-ab8f-4254190fd901",
      "relationship_type": "affected-organization",
      "source_ref": "incident--944ed4b2-b3fc-55e6-8b2d-ca784a35f58d",
      "target_ref": "identity--670cc84f-9f88-58bc-85ae-fba1764566f2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:f9ef855b-cca2-427b-bf5a-48b1a14cc7f2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a98bf6ac-4263-5d47-8dfd-7c8f9ef8f8b4",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:ce0afaac-32ee-4af7-ac1f-8dd9b8adcfa6",
      "relationship_type": "resulted-in",
      "source_ref": "incident--944ed4b2-b3fc-55e6-8b2d-ca784a35f58d",
      "target_ref": "x-ally-event--d5aa120a-a334-57d9-83d4-7c0f6a1f8c3d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:97faa7c9-993e-48c1-bcf2-bac3bab55de1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1c8db029-cf64-5995-813b-1bcd8c332e7c",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:8a7e3d21-68fb-4740-9853-8c863c399536",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:8b8db44a-292b-4602-b498-fc51e6c526bc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-21"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--29e518de-40dd-5fad-8dc3-f5fefd886809",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:ac1fd6ec-2591-4217-bce8-1ee8e867da3a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:cdc352c4-7c54-485a-8e3e-30f421dd54b7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "TeamUpdraft said it closed the entry route, signed out accounts, rotated keys and reported the incident to authorities, including the ICO and police."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--47cc29d3-afdb-534b-8c03-6512feae1435",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:ae3747e3-8e26-494f-8b25-73288f39b953",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:c2c2bd87-df3e-4978-bb1f-7d413ed992f3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The October 21 15:35 BST update urged Premium users to review their sites even if they had never knowingly used UpdraftCentral."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--654227ad-0512-5bee-8db2-9925f2166c05",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:c9b8811f-b4d1-4ad5-b025-63699a0d4650",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:097cc04a-609d-4c2c-81b8-bde9d3f64469",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-19"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9c450579-bed8-586e-8831-5ba888254cd2",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:e1340734-dc70-4cca-b7f6-148e516fdcbf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:238369b9-b2cb-4b71-8a37-cbf2c762ecb1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The October 20 update said UpdraftPlus 1.26.13 and 2.26.13, released after 22:00 BST on October 19, revoked UpdraftCentral connection keys."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c214b51d-b470-5078-8f02-ec454a6ed120",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:11fbc3ac-853a-4555-b52b-c5badf7786d8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:37a1c6be-cc2b-4e74-93ab-23091ad35150",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "TeamUpdraft said plugin downloads, self-hosted UpdraftCentral and backups in customers’ own remote storage were not affected; connected-site compromise still required separate review."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ccdf7efd-9051-58d0-826b-2d6169153c8a",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:a03715b5-43c6-4608-9a97-52f6e9f7011b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Patchstack",
          "url": "https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/",
          "external_id": "cit:e35d4dd8-b2ca-49db-8ef6-27ca41dead28",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9d398cfe669ebabb64d5f7da979d445c6d3f84ed503bb98c0a99ac4b68a4879f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Patchstack analyzed malicious plugins delivered through valid signed UpdraftCentral commands and described privileged backdoor accounts that could survive plugin removal."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cfd67570-5584-5b47-87c1-9dfbe0283696",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:beb2c3f3-06ad-443f-9e73-721cee67ab5e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:48d9fd3a-0bd6-4204-bdc6-36a78caf99f7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "TeamUpdraft believed its customer database was accessed; it held names, contact and billing details, order history, password hashes, two-factor settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e2fc70de-228e-5ced-8984-de68f05c9080",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:3a268d64-2da9-4cc5-9854-332f07bec262",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:5d53c455-90b6-47aa-bb57-2ae9770b84ac",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "TeamUpdraft confirmed that an attacker abused connections to customer websites to create administrator accounts and install malicious plugins; the extent remained unknown."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e36c96a7-1681-550d-8cf2-e1f00cd6425d",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:064a5ed4-7ca1-4160-9ba3-384937545f0a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:23fcce2e-2700-416f-a0d1-af2167b91ec8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-19"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--eee4c489-7d78-5e5f-87e1-d44858157240",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:e543e765-a381-4267-86de-95e54c949cec",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "TeamUpdraft",
          "url": "https://teamupdraft.com/blog/security-incident-october-2026/",
          "external_id": "cit:6ae84b90-c9c5-4867-b3f4-ba55bed5678e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:14c7e07b5b9516863c87e58fbb52df2347f4e3c1aea53d6d32719288081652b9"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "TeamUpdraft detected unauthorized access to its website during October 17–18 and said the attacker used a compromised key."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--8d104ff4-a3ae-53ee-8af4-faa0fcc69365",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "evt:89581489-a0e1-4dc4-ae4b-995d890c495b",
      "name": "Customer-site misuse and expanded review guidance confirmed"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--d5aa120a-a334-57d9-83d4-7c0f6a1f8c3d",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "evt:1e58dec2-9651-4b0f-9f81-f2730a9c7b9f",
      "name": "Disclosure and key-revocation release"
    }
  ]
}