# TeamUpdraft Breach Exposes WordPress Sites to Remote Takeovers

> Attackers used stolen UpdraftCentral keys from a recent TeamUpdraft security breach to install malicious plugins on an estimated 400,000 WordPress websites.

By PrimaryBrief newsroom · Published 2026-10-24T01:04:58.646807Z
Canonical: https://primarybrief.com/article/teamupdraft-breach-exposes-wordpress-sites-to-remote-takeovers-2d3fa7a7

A security breach over October 17-18, 2026, allowed attackers to access TeamUpdraft's customer database, exposing UpdraftCentral connection keys and potentially compromising 400,000 WordPress websites [2][5][6][10]. Many WordPress site owners use UpdraftPlus, often unknowingly holding active UpdraftCentral keys, making their sites vulnerable to remote takeovers following this incident [10].

## What the records show
TeamUpdraft's website infrastructure was breached on October 17-18, 2026, leading to access of its customer database [5][6]. This database contained customer names, emails, hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone [4][5][8]. Attackers used these stolen UpdraftCentral keys to install malicious plugins, creating hidden administrator accounts with high permissions on WordPress sites [3][5][10]. TeamUpdraft confirmed no credit card details were stored [4][8]. The UpdraftPlus plugin and remote backups were not compromised [4][8].

## The timeline
The breach of teamupdraft.com occurred October 17-18, 2026 [6]. Attackers began exploiting stolen keys on October 18, installing backdoor plugins for about 18 hours [3][10]. On October 19, TeamUpdraft released UpdraftPlus versions 1.26.13 and 2.26.13 to disconnect old UpdraftCentral keys [1][8][11]. Wordfence deployed emergency firewall rules to customers the same day [6]. By October 20, Imunify360 and InMotion Hosting deployed WAF rules to block attacker activity and began detecting backdoor plugins [12][16].

## What changed and for whom
TeamUpdraft closed the access route, fixed the vulnerability, and reset login security for its accounts [6][8]. Updated UpdraftPlus versions 1.26.13 and 2.26.13 automatically disconnect older UpdraftCentral connections [1][8]. Site owners should update UpdraftPlus and manually delete any remaining UpdraftCentral keys via `Settings > UpdraftPlus > Advanced Tools > UpdraftCentral` [14]. If compromise is suspected, change all administrator passwords, log out sessions, and re-authorize remote storage [9][12][13].

## What the subject has said publicly
TeamUpdraft disclosed the unauthorized access to its website on October 17-18, 2026 [6][8]. The company believes its customer database was accessed, including connection keys [6]. TeamUpdraft stated no customer card details were stored [4][8]. The company engaged an external cybersecurity firm and cooperated with police, reporting the incident to the UK Information Commissioner's Office [1][4][6]. TeamUpdraft suggested AI was used to accelerate the attack [1].

## What we could not confirm
The precise number of actually compromised WordPress websites is unconfirmed, beyond the estimated 400,000 potentially exposed sites. The identity of the attackers remains unconfirmed. Specific outcomes of the police investigation and the external cybersecurity firm's findings were not available in the records.

## Evidence cited
1. (October 19 2026) We have bought in an external leading cyber security firm to assist as an extra precaution (as well as our-in-house experts). We have contacted the relevant authorities (including the police) about this and are co-operating with them as they investigate. The update to UpdraftPlus pushed on the 19th (1.26.13 & 2.26.13) automatically disconnects user sites from UpdraftCentral by revoking connection keys. The attacker exploited the connection to users' sites to create admin accoun (teamupdraft.com) — https://teamupdraft.com/
2. (October 21 2026) UpdraftCentral keys used to backdoor WordPress sites following TeamUpdraft breach (scworld.com) — https://scworld.com/
3. (October 21 2026) TeamUpdraft Website Breach Exposes UpdraftCentral Keys, Backdoors WordPress Sites (itcpeacademy.org) — https://itcpeacademy.org/
4. (October 21 2026) Stolen UpdraftCentral keys allow attackers to backdoor WordPress sites (csoonline.com) — https://csoonline.com/
5. (October 22 2026) Critical UpdraftCentral Security Breach: What WordPress Users Must Do Now (hostarmada.com) — https://hostarmada.com/
6. (October 19 2026) Stolen UpdraftCentral Keys Used To Backdoor WordPress Sites (wordfence.com) — https://wordfence.com/
7. (October 21 2026) UpdraftCentral Connection Key Compromise: What WordPress Site Owners Should Do Now (inmotionhosting.com) — https://inmotionhosting.com/
8. (October 21 2026) Stolen UpdraftCentral Keys Actively Used to Backdoor WordPress Sites (thehackernews.com) — https://thehackernews.com/
9. (October 20 2026) UpdraftPlus backdoor attack: What happened, affected sites, and how to fix it. (wp-staging.com) — https://wp-staging.com/
10. (October 19 2026) Stolen UpdraftCentral keys are backdooring WordPress sites. Here's what to do. (wp-umbrella.com) — https://wp-umbrella.com/
11. (October 21 2026) Updraft Website Compromised (searchenginejournal.com) — https://searchenginejournal.com/
12. (October 20 2026) Stolen UpdraftCentral Keys Actively Used to Backdoor WordPress Sites - Imunify360 (imunify360.com) — https://imunify360.com/
13. (October 21 2026) Cyber security news: WordPress backdoors, PHP emergency patches, eMudhra certificate compromise (substack.com) — https://substack.com/
14. (October 21 2026) UpdraftCentral Key Compromise: WordPress Sites Vulnerable to Backdoors (gbhackers.com) — https://gbhackers.com/
15. (October 21 2026) Attackers are exploiting stolen UpdraftCentral connection keys, exposed in a breach of TeamUpdraft's site, to install malicious plugins and gain persistent...  (daily.dev) — https://daily.dev/
16. (October 20 2026) UpdraftCentral Breach Response: InMotion Hosting Proactive Measures (inmotionhosting.com) — https://inmotionhosting.com/blog/updraftcentral-breach-response/