Most UpdraftPlus sites aren't affected by the TeamUpdraft breach. Only sites connected to the cloud UpdraftCentral dashboard are. To check, open Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral. If it shows "Manage existing keys (N)" with N above zero, you're connected. Note that UpdraftPlus 1.26.11 pre-ticks "add this site to UpdraftCentral" when you connect a TeamUpdraft account, so you may be connected without remembering it.

1. Update to 1.26.13 (free) or 2.26.13 (Premium) or later. Skip 1.26.12 / 2.26.12; Nethemba reports they delete no keys.
2. Delete every key on that screen, or with WP-CLI: wp option delete updraft_central_localkeys. Removing the site from the teamupdraft.com dashboard isn't enough.
3. Check Plugins (including Must-Use) and Users for anything you didn't add, change admin passwords, and change your teamupdraft.com password and 2FA.
4. Backups to your own Google Drive, Dropbox or S3 keep working. UpdraftVault users need to reconnect with their new password.
5. If you manage client sites, use a key created by an account that can't install plugins. That's what stopped the attack on one of Nethemba's sites.