UpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites
Do Son 
TL;DR
TeamUpdraft says attackers likely accessed its customer database over the weekend of 17-18 October. The UpdraftPlus data breach included UpdraftCentral connection keys. Within hours, researchers saw those keys used to plant backdoors on WordPress sites.
What Was Exposed
“We believe our customer database was accessed,” TeamUpdraft wrote. The database holds names, email addresses, billing addresses and order history. It also stores hashed passwords and two-factor authentication settings.
Most important, it contains connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. On the other hand, payment data stayed safe. “We do not store any card details,” the company said, since Stripe and PayPal handle payments.
TeamUpdraft has not shared how many accounts it holds. For scale, UpdraftPlus runs on more than four million WordPress sites, but most free users have no account.
How It Happened
TeamUpdraft has not described the entry point. It says it “closed the access route” and fixed “the underlying weakness.” Importantly, the UpdraftPlus plugin and its downloads were not tampered with.
Stolen Keys Fuel an UpdraftCentral Backdoor Campaign
The stolen keys quickly came into play. Patchstack observed signed UpdraftCentral commands installing malicious plugins between 18 and 19 October. “The commands are correctly encrypted and signed with genuine dashboard private keys,” Patchstack noted. As a result, the target sites treated them as legitimate.
The backdoor creates a hidden account with editor rights plus plugin-install power. It then logs the attacker in through a cookie, which skips the login form and 2FA. Security firm Nethemba found the plugin on two of its own fully patched sites.
Who Is Affected
Every teamupdraft.com account holder should assume their data leaked. UpdraftCentral cloud users face the highest risk from the UpdraftPlus data breach. Self-hosted UpdraftCentral and backups in Google Drive, Dropbox or Amazon S3 are not affected.
What Affected People Should Do
All Account Holders
- Change your teamupdraft.com password, and change it anywhere you reused it.
- Reset your two-factor authentication in My Account.
- Ignore emails asking for passwords or keys.
UpdraftCentral Cloud Users
“Your UpdraftCentral connection keys can send commands to your connected sites, so please secure each site directly,” TeamUpdraft warned. Log in to each WordPress dashboard directly. Next, update UpdraftPlus to 1.26.12 (free) or 2.26.12 (Premium), and delete the old connection key.
After that, look for unknown admin accounts and plugins, including Must-Use plugins. Patchstack flags any plugin described as a “Small maintenance toolkit” and users named “Site Tools.” If you find either, restore from a backup taken before 17 October.
Company Response
TeamUpdraft signed out every account and rotated its payment provider keys. It also disconnected all UpdraftVault sites and replaced every UpdraftClone client key. Furthermore, the new UpdraftPlus releases cut every UpdraftCentral connection made before 22:00 BST on 18 October.
The company has reported the incident to the UK Information Commissioner’s Office. Full details appear in the TeamUpdraft security incident notice.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
