UpdraftCentral keys compromised: a site-by-site checklist for agencies

On the weekend of 17–18 October 2026, TeamUpdraft (the company behind UpdraftPlus) detected unauthorised access to teamupdraft.com and found that its customer database was accessed. That database held, among other things, the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. On 21 October TeamUpdraft confirmed that the attacker used a compromised UpdraftCentral key to create administrator accounts and install plugins on sites; the full extent is still being investigated. If you manage client sites through UpdraftCentral (cloud), treat every site that was listed there before 18 October as possibly touched. This guide turns the official advice into a site-by-site checklist you can hand to anyone on your team, and adds what to tell clients.

Everything about the incident itself comes from TeamUpdraft’s security notice (published 19 October, last updated 22 October at the time of writing). Check it for the latest status before you start.

First: are you affected?

• You used UpdraftCentral (cloud) to manage sites: affected. Its connection keys were compromised and at least one was used. Work through every listed site today.
• You use self-hosted UpdraftCentral: not affected, according to TeamUpdraft.
• You use UpdraftVault: all sites were disconnected and new credentials issued. You need to reconnect each site (see below).
• You shared UpdraftClone keys with clients: old keys no longer work; send your clients the new ones.
• You have a teamupdraft.com account at all: change that password and any place you reused it.
• Free UpdraftPlus without a teamupdraft.com account: no action required, but keep the plugin updated.

The plugin downloads were not affected, and backups you send to your own remote storage (Google Drive, Dropbox, Amazon S3 and similar) were not affected either. Card details were not stored by TeamUpdraft. If a site was reached through UpdraftCentral, TeamUpdraft advises re-authorising its remote storage and changing the storage access keys as a precaution.

Make a list before you touch anything

With many client sites, the risk is skipping one. Export or copy the list of sites connected to UpdraftCentral first, and give every site a row: site, who checked it, time, admin users OK, plugins OK, key deleted, passwords changed, reconnected. It takes five minutes and it is what you will show the client later.

The checklist for every connected site

Do this through the site’s own WordPress dashboard (log in at the site itself), not through UpdraftCentral. Type the address yourself rather than clicking links in emails.

1. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. These releases revoke UpdraftCentral connection keys made before 13:07 BST on 18 October. WordPress.org pushed the update automatically, but check the version on every site.
2. Delete the old connection key under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral.
3. Check Users. Filter on Administrator and on Editor, and remove any account you do not recognise. Note its username and creation date before you delete it; you may need them later.
4. Check Plugins, including the Must-Use tab. Remove anything you did not install. Attackers like plugins with harmless-sounding names, and must-use plugins do not show up in the normal list.
5. Change the passwords of all administrator accounts, including your own agency account on that site.
6. If anything looks suspicious, restore a backup from before 17 October, then repeat the checks on the restored site.
7. Re-authorise remote storage (Google Drive, Dropbox, S3 and similar) and change those access keys if the site was listed in UpdraftCentral.
8. Reconnect the site to UpdraftCentral only when the steps above are done. Sites you reconnect this way will not be disconnected again by the update.

Look a little further than the official list

The official steps cover the obvious entry points. On sites that matter (shops, membership sites, anything with customer data), spend ten more minutes:

• Unknown files and folders in the web root and in wp-content, and unfamiliar IP addresses in your access logs, especially recently modified PHP files or folders with random names or only numbers.
• Scheduled tasks you do not recognise (WP-Cron entries, via a tool such as WP Crontrol or WP-CLI wp cron event list).
• Application passwords on administrator profiles. They survive a normal password change.
• Outgoing redirects and spam: open the site on a phone, logged out, and search Google for site:clientdomain.com to spot pages you never made.
• Your security plugin or host’s malware scan, run once now that you know there may be something to find.

UpdraftVault and UpdraftClone

UpdraftVault: on each site go to Settings → UpdraftPlus → Settings, choose UpdraftVault under remote storage, click Connect under “Already got space?”, enter your teamupdraft.com email with the new password, save, and run one manual backup to prove it works. Until you do this, those sites are not sending backups to Vault.

UpdraftClone: if you never created client keys, nothing to do. If you did, copy the new keys from My Account → UpdraftClone → UpdraftClone Key Management and send them to the clients who use them.

What to tell your clients

Clients hear about breaches from the news or from a nervous colleague. It is better if they hear it from you, briefly and with the work already done. A short message is enough:

“A backup tool we use announced a security incident on 19 October. We checked your site: no unknown administrator accounts or plugins, passwords changed, connection renewed. No action needed from you. We will keep an eye on it.”

Only send that once it is true for that site. If you found something, say what you found, what you restored, and what you are watching next. Watch for phishing too: TeamUpdraft says it will never ask for passwords or keys by email, so any message that does is not from them.

The lesson for every central dashboard

This is not only about one vendor. Any tool that manages many sites from one place holds a key to each of them: a backup dashboard, a management console, a hosting panel. A few habits limit the damage when one of them is breached:

• Keep an up-to-date list of which tools are connected to which client sites.
• Use unique passwords and two-factor authentication on every vendor account.
• Keep backups somewhere you control, with more than one copy, and test that they restore.
• Prefer tools that log every login and action they take on a site, and that the site owner can switch off from inside WordPress.
• Know who on your team does what on the day of an incident, before the day comes.

How Verploy handles this

Verploy connects to client sites through a small connector plugin. One-click logins to WP Admin from Verploy are recorded, and the site owner can switch them off in WordPress (Settings → Verploy). Every update is checked. Risky ones tested on a copy first. More on the WordPress maintenance for agencies page.