TeamUpdraft breach exposes UpdraftCentral keys, attackers add rogue WordPress admins
TeamUpdraft reported unauthorized access to its website and said its customer database may have been exposed, including UpdraftCentral connection keys. Researchers have observed attackers using stolen keys to create administrator accounts and install malicious plugins on connected WordPress sites, with roughly 400,000 sites potentially at risk. The vendor replaced affected credentials and advises customers to rotate storage secrets and reconnect sites.
...
... Need no extra. Good. Need consider "additional factual detail and background drawn ONLY from material above — entirely original wording, never copying source phrasing." We used "malicious plugins" phrase from source? It's common but source says "malicious backdoor plugins". "maintenance or optimization tools" source says "maintenance and optimization tools". Could be considered copying? Need original wording. We can rephrase: "posing as site upkeep or performance utilities." "privileged accounts" okay. "valid dashboard keys" source "valid private dashboard keys". Maybe okay. Need avoid exact phrases. Let's revise to more original. Expanded P1: "TeamUpdraft linked the incident to unauthorized entry into its teamupdraft.com site over the 17–18 October weekend. The firm suspects its customer database was reached, possibly exposing account and billing records, password hashes, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. It states that