TeamUpdraft
ModerateConfirmedDigital services
TeamUpdraft, the publisher of the UpdraftPlus and UpdraftCentral WordPress plugins, detected unauthorised access to its teamupdraft.com website over the weekend of 17-18 October 2026. It believes its customer database was accessed, containing customer and billing details, order history, password hashes, two-factor authentication settings and connection keys for the UpdraftCentral, UpdraftVault and UpdraftClone services. The company states it does not store payment details, and that it closed the access route, signed out all accounts and replaced the keys and credentials that could have been affected. According to Patchstack, websites connected through UpdraftCentral have been targeted with malicious plugins since 18 October 2026. The number of people affected has not been disclosed.
Stolen UpdraftCentral connection keys allow a third party to send commands to the linked WordPress sites, for example to install a malicious plugin or create administrator accounts.
- Disclosed on
- October 19, 2026
- Incident dated
- October 17, 2026
- Sector
- Digital services
- Country
- International or undetermined
- Cause
- Undisclosed
Exposed data
- Order history
- Password (hashed)
- Connection data (IP, logs)
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts.
- Turn on two-factor authentication on the affected accounts: a stolen password is then no longer enough.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact