DreamHost Confirms Breach of File Manager, Exposing FTP and Webmail Session Data

What Happened

According to BleepingComputer, web hosting provider DreamHost has confirmed a data breach. Attackers gained unauthorized access to its File Manager platform for about two months. During that window, the attackers stole customers' FTP/SFTP usernames and passwords, along with data tied to webmail sessions. Full technical details of the intrusion have not been disclosed.

Why It Matters

FTP/SFTP credentials typically grant direct access to a customer's website files. That access can be used to deploy web shells, tamper with content, or inject malicious code served from the affected sites. Exposed webmail session data could enable session hijacking or account takeover without re-authentication. Because DreamHost is a shared hosting provider, the breach may affect many independent websites and businesses, some of whom may not yet know their credentials were exposed.

What Defenders Should Do Now

• If you use DreamHost, rotate all FTP/SFTP and webmail credentials now. Do not reuse those passwords elsewhere.
• Review FTP/SFTP and webmail access logs for the affected window. Look for unfamiliar source IPs, logins at unusual hours, and files you did not create or change.
• Check website file integrity for unexpected changes such as new PHP files, modified index pages, or unfamiliar scheduled tasks. These can indicate a web shell was dropped using stolen credentials.
• Enable multi-factor authentication where the hosting control panel or webmail supports it. Move off plaintext FTP to SFTP or FTPS where it is still in use.
• Monitor for phishing and credential-stuffing attempts that may use the exposed usernames, since stolen credentials are often reused against other services.

Developing Story

This is based on an initial vendor disclosure and reporting. Further details, including root cause, full scope of affected accounts, and remediation steps from DreamHost, are still emerging. Treat this as developing information and consult DreamHost's own advisories for authoritative guidance. Read the original report at BleepingComputer.