DreamHost Discloses File Manager Breach Exposing FTP and Webmail Credentials for Nearly 10% of Users

Hosting and domain registrar DreamHost disclosed that attackers exploited a software vulnerability in its web-based File Manager to breach servers running the service, starting in August and remaining undetected until October 23. Threat actors stole FTP and SFTP usernames and passwords for certain users and accessed portions of the Webmail system to obtain session tokens and login credentials, potentially viewing some mailbox contents. Investigations indicate that nearly 10% of user email and FTP/SFTP accounts were affected, though exact numbers were not released. DreamHost stated there is no evidence that control panel logins or customer billing and payment data were compromised. The company shut down the affected servers, patched the flaw, terminated sessions, and forced password resets for impacted accounts.

Key takeaways

• Attackers exploited a File Manager flaw starting in August, which remained undetected until October 23.
• The intrusion resulted in the theft of FTP/SFTP credentials and Webmail session tokens and login data.
• Nearly 10% of accounts were affected, but DreamHost found no evidence of compromised control panel or billing data.
• The vendor disabled affected servers, patched the vulnerability, and enforced password resets for affected users.