{"id":19055109,"date":"2026-10-26T12:24:10","date_gmt":"2026-10-26T12:24:10","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/hacking-still-active\/"},"modified":"2026-10-26T12:24:10","modified_gmt":"2026-10-26T12:24:10","slug":"hacking-still-active","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/hacking-still-active\/","title":{"rendered":"Hacking still active?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Last Monday I was victim to the hacking on two of my sites as a user of Updraft backup. A new admin user was created and installed malicious plugins on two sites. I was able to fix this and went through all the steps the Team Updraft page listed: <a href=\"https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/\">https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/<\/a> (except for reconnecting Updraft Central &#8211; I had not done that yet, as the backups still showed as live each of my four pages).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Today I got a notification on a third site that a new admin was added &#8211; with the a similar username (svc5wmkhqxwm; on my other sites it always started with svc and the email always ended with @example) <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I was able to login to the page today and delete the user, delete the two plugins, restore my plugins folder to what it was on 10\/06, and then login to Updraft &#8211; but I&#8217;m wondering if there&#8217;s still some error with this plugin that they were able to get in? My history plugin shows a known admin created the new user yesterday &#8211; so they were able to access information to login as that known admin &#8211; and then create an account for themselves. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Are there any other steps I should be taking? Or is there a known second round of breach?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thanks<\/p>\n","protected":false},"template":"","class_list":["post-19055109","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19055109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19055109\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19055109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}