It wasn’t my fault this time. I swear!
It turns out that the the company whose plugin I use for weekly backups was—in their words—”suffered unauthoriised access.”
Over the weekend of 17-18 October we identified unauthorized access to our website. Our team responded straight away and worked through the night to contain it. We closed the access route, signed out every account and replaced the keys and credentials that could have been affected.
What was accessed
We believe our customer database was accessed. It holds:
-
-
names, email addresses, billing addresses and order history
-
account passwords, stored only in hashed (scrambled) form and never in plain text
-
two-factor authentication settings
-
connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
-
We never store full card numbers. Payments are handled by Stripe and PayPal. The UpdraftPlus plugin itself and its downloads were not affected.
What we have already done
-
-
Closed the access route and secured the website
-
Signed out every account and reset login security across the site
-
Disconnected every site from the vault and issued new credentials
-
Replaced every client key.
-
Rotated our keys with payment providers and other connected services
-
Started work on an emergency release that will automatically disconnect our old connections
-
What you need to do
-
-
Change your account password. Type the name of the website directly into your browser rather than following a link.
-
If you use the same password anywhere else, change it there too.
-
If you use two-factor authentication with our website, reset it in My Account.
-
Be cautious of unexpected emails that claim to be from us. We will never ask for your password or keys.
-
It appears that someone also installed a plugin of unknown origin remotely on my site. That’s been eliminated.
Let me know either in the comments here or email directly (link at right) if you run into any further issues.
0 comments