UpdraftCentral (UpdraftPlus) Compromise
‼️
Impact: WordPress sites with the UpdraftPlus plugin installed that are connected to UpdraftCentral/UpdraftVault/UpdraftClone
We are writing to inform you of a security incident that was reported by UpdraftPlus on 18 October 2026 (https://teamupdraft.com/blog/security-incident-october-2026/).
What happened?
- UpdraftPlus, the vendor for the common backup plugin of the same name, detected a compromise of their customer database on 18 October 2026
- Account contact information, hashed passwords, 2FA settings, and connection keys for Updraft various cloud services were accessed
Current Status
- UpdraftPlus is invalidating all keys used for their cloud services and disconnecting connected sites
- Reclaim Hosting is removing stored UpdraftCentral keys from hosted WordPress sites
Next Steps
- ACTION REQUIRED: If you are an UpdraftPlus user, reset your password a 2FA key for UpdraftPlus's portal and update the plugin on your site(s)
- ACTION REQUIRED: If you are an UpdraftPlus user with sites connected to UpdraftCentral or another of their cloud service, invalidate keys/disconnect your site
Contact our Support Team
If you have any further questions or need assistance, please contact our support team.
