We told you on October 19 that no update stopped the UpdraftCentral key attacks. That has changed. TeamUpdraft has released fixes and explained how the breach happened.

What happened

TeamUpdraft says its own website, teamupdraft.com, was accessed without permission on October 17 and 18. The company believes an attacker used a compromised key to get in. It then used UpdraftCentral connections to reach customer sites.

The attacker reportedly created admin accounts and installed malicious plugins. TeamUpdraft says the full extent is unknown. It has contacted the police and reported the incident to the UK data regulator, the ICO.

The fix

UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) revoke UpdraftCentral connection keys made before the cutoff of 13:07 BST on October 18. WordPress.org has pushed the update to all users. The update disconnects your site from UpdraftCentral, so you must reconnect it afterward.

What data was exposed

TeamUpdraft believes the attacker reached its customer database. That held names, email and billing addresses, and order history. It also held password hashes, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.

Card details were not stored, because Stripe and PayPal handle payments. Backups in your own remote storage are reportedly unaffected.

What to do

  1. Update UpdraftPlus to 1.26.13 or 2.26.13 or later on every site.
  2. Change your teamupdraft.com password. Type the address into your browser yourself. Reset two-factor authentication in My Account, and change any reused password elsewhere.
  3. Delete your UpdraftCentral key in Settings, UpdraftPlus, Advanced Tools, UpdraftCentral.
  4. Check each site. Remove unknown admin or Editor users, and unknown plugins, including Must-Use plugins. Change all admin passwords.
  5. Restore if needed. If anything looks wrong, use a backup from before October 17.
  6. Reconnect to UpdraftCentral once the site is clean.

UpdraftVault users were disconnected and must reconnect with new credentials. UpdraftClone keys were replaced, so copy the new ones from My Account.

Free UpdraftPlus users without a TeamUpdraft account only need to keep the plugin updated. Be wary of emails claiming to be from TeamUpdraft.

End of article