What Happened
The Hacker News reports attackers accessed the teamupdraft.com website, home of the UpdraftPlus backup plugin with more than four million installations. TeamUpdraft identified the access over the weekend of October 17 and 18. The customer database held names, email addresses, billing addresses, order history, hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
Patchstack observed an attacker with valid UpdraftCentral keys sending signed plugin upload commands to connected sites for about 18 hours on October 18 and 19. The backdoor creates an Editor account named data-ops43 with install and option-management permissions. A second layer leaves a known-password account behind after plugin removal. Patchstack counted 99 backdoor plugin names.
Why This Matters for Canadian Organizations
A management key works like an administrator credential. Canadian agencies, managed service providers, and small businesses use UpdraftCentral to run many WordPress sites from one dashboard. One stolen key set reaches every site in the dashboard.
A backdoored site holding customer records, donor details, or patient intake forms starts a PIPEDA breach assessment. TeamUpdraft reported the incident to the UK ICO. Canadian customers of TeamUpdraft should assume their order history and billing details are in attacker hands.
What to Do
Update UpdraftPlus to 1.26.13 free or 2.26.13 Premium, which disconnect connections made before 10 p.m. BST on October 18. Log in to each site directly, not through UpdraftCentral. Delete the UpdraftCentral key under Settings, UpdraftPlus, Advanced Tools.
Review Users for unknown administrators and Editors. Review Plugins and Must-Use plugins for unfamiliar entries such as Site Health Cache, Content Helper, and Nav Hub. Change administrator passwords, re-authorize remote storage, and rotate storage keys. If you find a compromise, restore from a backup taken before October 17. Reset your teamupdraft.com password and 2FA, and change the password anywhere you reused it. See our TechTalk archive for related WordPress coverage.
