Updraft (WordPress Backup) compromised
Description
The TeamUpdraft.com website was compromised on October 17-18, 2026, resulting in unauthorized access to customer data including names, emails, billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The UpdraftPlus plugin and backups stored on third-party remote storage were not affected. Attackers appear to be using compromised backup datasets to create new administrator accounts on WordPress sites using Updraft. The vendor has contained the breach, reset credentials, and is releasing emergency updates to disconnect old keys and connections. Users are advised to change passwords, check for unauthorized admin accounts, remove suspicious plugins, and follow specific remediation steps for UpdraftCentral, UpdraftVault, and UpdraftClone users.
Reddit Discussion
In addition to ConnectWise Cloud Backup, Updraft Cloud Backup was also compromised on the 17th/18th.
Much like with CW, the vendor's advice to customers would indicate that the platform itself wasn't the primary target, but rather the attacker is utilizing the dataset stored in the backup systems to get into customer environments instead.
No evidence that the two attacks are related, but it would be a hell of a coincidence.
https://teamupdraft.com/blog/security-incident-october-2026/
If you manage a WordPress site that uses Updraft, follow the remediation guidance ASAP. It appears that the attacker(s) are creating new admin accounts in WordPress sites.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On October 17-18, 2026, unauthorized access was detected on the TeamUpdraft.com website, compromising customer data including personal details, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services. The UpdraftPlus WordPress plugin and backups stored on external remote storage services were not affected. The attackers are reportedly leveraging compromised backup data to create new administrator accounts on WordPress sites using Updraft, potentially gaining control over those sites. The vendor responded by closing the access route, signing out all accounts, resetting credentials, disconnecting sites from affected services, and preparing emergency plugin updates to invalidate old connection keys. Customers are instructed to change passwords, verify and remove unauthorized admin accounts and plugins, and reconnect services using new credentials. The incident is under investigation with ongoing monitoring and regulatory reporting.
Potential Impact
Customer personal data and connection keys for Updraft services were accessed, potentially allowing attackers to create unauthorized administrator accounts on WordPress sites using Updraft. The breach does not affect the UpdraftPlus plugin itself or backups stored on third-party remote storage. The compromise could lead to unauthorized site control if remediation steps are not followed.
Defensive Guidance
The vendor has closed the access route, reset all credentials, disconnected affected services, and is releasing emergency updates to invalidate old connection keys. Customers must change their TeamUpdraft.com passwords, reset two-factor authentication, and be cautious of phishing attempts. UpdraftCentral users should disconnect sites from UpdraftCentral, remove unknown admin accounts and suspicious plugins, change admin passwords, and reconnect sites after remediation. UpdraftVault users must reconnect sites with new credentials. UpdraftClone users need to distribute new client keys to their clients. Free UpdraftPlus users without a TeamUpdraft.com account do not need to take action. Following these steps will mitigate the risk of unauthorized access.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":30,"reasons":["external_link","newsworthy_keywords:compromised","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["compromised"]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ad642ca2cdf04f6566ad990
Added to database: 10/19/2026, 16:18:18 UTC
Last enriched: 10/19/2026, 16:18:24 UTC
Last updated: 10/19/2026, 18:18:18 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.