TeamUpdraft confirmed that attackers got into its website and probably its customer database, turning a popular WordPress backup plugin into a back door. For the second time this month, a backup tool has turned into a way in. Last week it was a Microsoft 365 backup service. This week it’s one of the most popular backup plugins for WordPress, the platform behind a huge share of small business websites. Within a day, stolen connection keys were being used to install malicious plugins and create admin accounts on customers’ WordPress sites.
What Happened
Over the weekend of October 17 and 18, TeamUpdraft identified unauthorized access to teamupdraft.com. The company believes its customer database was accessed. That database holds names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for its UpdraftCentral, UpdraftVault, and UpdraftClone services. TeamUpdraft says it doesn’t store card details; payments run through Stripe and PayPal. The company says the attacker used a compromised key to get into its site, and it has reported the incident to police and the UK Information Commissioner’s Office.
The connection keys are the dangerous part. UpdraftCentral is a cloud service that lets administrators manage many WordPress sites from one dashboard, and its keys can send commands to every connected site. Whoever holds them can act on those sites without ever logging in to them.
How Attackers Used the Keys
WordPress security firm Patchstack says attacks began on October 18. Attackers pushed malicious plugins through UpdraftCentral to gain persistent access and create administrator accounts. Patchstack has identified at least 99 variants of these plugins, some disguised as routine maintenance or optimization tools. Some can create privileged accounts or sign in as existing administrators, and others are built to hide from WordPress’s standard admin screens. Security firm Nethemba reported that attackers targeted three of its own sites this way and successfully installed malicious plugins on two.
TeamUpdraft says the speed of the attacks, along with backdoor plugins that were faulty at first, suggests the attackers used AI to accelerate their work. It also says it has seen a pattern of unexpected “editor” accounts on affected sites.
That detail matters. Most site owners check for unfamiliar administrators, but an editor account is easy to overlook, and some of the malicious plugins are specifically designed not to show up where you’d normally look. Researchers cited by CSO Online noted that sites already compromised can stay at risk even after the stolen keys stop working, which is why a quick glance at your dashboard isn’t enough.
What’s Affected and What Isn’t
UpdraftPlus has more than four million active installations, but only sites connected to UpdraftCentral’s cloud service through an active key were exposed to this attack. Self-hosted UpdraftCentral isn’t affected. TeamUpdraft says the plugin itself and its downloads weren’t compromised, and backups stored in your own Google Drive, Dropbox, or Amazon S3 weren’t affected.
On October 19, TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which disconnect UpdraftCentral connections made before 13:07 BST on October 18. WordPress.org pushed the update to all users. But revoking the keys doesn’t remove rogue plugins, accounts, or sessions an attacker already created. TeamUpdraft is also urging every Premium user to check their sites, even those who never used UpdraftCentral.
Why the TeamUpdraft Breach Matters for Your Organization
Small businesses often hand website upkeep to an agency, a freelancer, or an IT provider, and those people are exactly the ones who use remote management tools to look after many sites at once. You might not know UpdraftCentral was ever connected to your site. A backdoored website can serve malware to your visitors, harvest form submissions, or quietly damage your reputation and search rankings. The pattern is the same one we saw with ConnectWise: a trusted management tool holds keys to many customers at once, and stealing those keys skips every lock on the individual doors.
What to Do This Week
- Ask whoever manages your site whether it uses UpdraftPlus, and whether it was ever connected to UpdraftCentral.
- Log in to the site’s own WordPress dashboard and confirm UpdraftPlus is on 1.26.13 or 2.26.13 or later.
- Delete any remaining UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools.
- Review Users for administrator or editor accounts you don’t recognize, and Plugins, including the Must-Use tab, for anything unfamiliar. Remove them.
- Change every administrator password and the teamupdraft.com account password, and reset two-factor authentication there.
- If you find signs of compromise, consider restoring from a backup taken before October 17, then re-authorize remote storage and rotate storage keys.
- Log in to UpdraftCentral and look for any site you didn’t knowingly connect since October 19.
The Takeaway
The tools that make websites easy to manage also concentrate risk. One stolen set of keys from the TeamUpdraft incident reached into thousands of sites at once. That doesn’t mean you should stop using backup and management plugins. It means you should know which ones are connected to your site, who holds the keys, and how you’d notice if something new showed up in your dashboard.
Not sure who has the keys to your website? Black Belt Secure can help you find out and lock it down. Schedule a free assessment today.
Source: CSO Online (Oct 21); TeamUpdraft security incident notice (Oct 19, updated Oct 23).