Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.

TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database.

The developer offers several WordPress tools for backup, storage, and site management:

"Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday.

"Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected."

The vendor says it believes the threat actor accessed its customer database, which included details about the customer and billing, order history, as well as more sensitive information: