We are getting in touch to give you a clear, direct update on the recent security incident involving UpdraftPlus, what it means for your site, and how we have fixed the server timeouts that blocked password resets.
We know how incredibly frustrating this situation has been, especially for those of you who tried to secure your accounts immediately but couldn’t get the website to load.
What happened
An unauthorized third party managed to access our database. This exposed some customer names, email addresses, password hashes, and service connection keys (specifically UpdraftCentral keys). Because of how these keys work, the intruder was able to run unauthorized modules on some connected WordPress sites, causing data corruption and security risks for those installations.
Why the site timed out (and how it’s fixed)
When the incident happened, our website was hit with a massive, sudden spike in traffic as everyone tried to update their credentials at the same time. This overloaded our authentication servers and caused the constant time-outs.
We have since scaled up our server capacity and optimized our database. The account dashboard and password reset systems are now fully stable, fast, and working exactly as they should.
The technical fixes we’ve put in place
To cut off the access route used in the incident, we took the following immediate steps:
- Invalidated old keys: We pushed out plugin updates (version 1.26.13 for Free and 2.26.13 for Premium) that automatically kill and disconnect any UpdraftCentral cloud connection keys created before the incident.
- Reset active sessions: We ended all active logins on our website to ensure everyone has to log back in fresh.
- Brought in experts: We hired an external cybersecurity firm to audit our systems, verify our fixes, and help us harden our ongoing security setup.
What you need to do next
Because the exposed keys interacted directly with individual WordPress dashboards before we could revoke them, please take a few minutes to check your site:
- Update UpdraftPlus: Make sure your site is running version 1.26.13 (Free) or 2.26.13 (Premium).
- Check your users: Look at the
Users panel in WordPress to make sure no strange administrator accounts have been added.
- Scan your plugins: Check your active plugins, including the Must-Use (mu-plugins) folder, for any files you don’t recognize.
- Change your password: Log into your account on our site to change your password and update your 2FA. The pages will load normally now.
Our support team is fully available if you need any technical help or guidance getting things sorted
