DreamHost's File Manager Server Was Open to an Attacker for About Two Months. FTP and SFTP Logins Were Taken, and DreamHost Has Not Said How Many Customers.
If you host with DreamHost and logged in to its web File Manager between August and October 23, treat your FTP or SFTP password as stolen, change it everywhere you reused it, and look at your site files and webmail rules for changes you did not make. DreamHost says the attacker exploited a vulnerability in the software on the File Manager server, and that it has since blocked the access, fixed the flaw, ended active sessions and invalidated passwords for potentially affected users.
What DreamHost says
This is from BleepingComputer's report on DreamHost's notification letter, published November 4. We did not read the letter itself, which is hosted as a PDF on the California Attorney General's site. Where we quote below, we are quoting BleepingComputer quoting DreamHost.
The notice says "an unauthorized third party accessed the server that runs our web-based File Manager" at files.dreamhost.com. It says the attacker "exploited a vulnerability in that software." The intrusion ran from August 2026 to October 23, the day DreamHost discovered it, about two months. DreamHost describes the attack as deliberate.
What was taken
- FTP and SFTP usernames and passwords of people who logged in to File Manager while the attacker was there.
- Webmail session information, including credentials, for what DreamHost calls a limited number of users, because the intruder may also have reached webmail systems.
Not stated: whether the passwords were hashed or stored in plaintext. BleepingComputer's report does not say, and that is the question that decides how bad this is. A plaintext or reversible store means every captured password works as-is.
What DreamHost says was not touched
DreamHost says it found no evidence the attacker accessed control panel login information. Billing and payment details are handled by an external provider, and DreamHost reports no evidence they were accessed. Those are absence-of-evidence statements from the company that was breached, made about a system an attacker sat in for two months. We report them as the company's position.
What DreamHost did, and what it asks of you
It blocked the attacker's access, addressed the exploited vulnerability, ended active sessions for potentially affected users and invalidated their passwords. DreamHost earlier required affected users to reset email and FTP/SFTP passwords. For recipients of the letter it recommends:
- Check website files for unauthorized changes.
- Review webmail forwarding rules and filters.
- Change passwords on any other account where the same credentials were used.
- Consider a fraud alert or security freeze on credit reports.
It offers one year of credit monitoring and identity theft protection through Equifax.
Why the first two items on that list matter most
An FTP or SFTP login is write access to a website. The usual follow-on is not a ransom note. It is a small change to a file you do not look at: a script tag added to a template, a hidden redirect, a web shell dropped in an uploads folder. A webmail forwarding rule is the same trick for email: it copies everything that arrives to someone else and survives a password change. If you were in scope, those two checks do more than the password reset, because the reset only closes the door and does not tell you whether someone already left something inside.
What is not known
How many customers were affected. BleepingComputer says its repeated questions on the number went unanswered. Which software and which vulnerability. What the attacker did with the logins. Whether any were used before they were invalidated. No indicators of compromise appear in the report, and we found none elsewhere, so there is nothing to put in the feed from this story.
Limits
One secondary report of one notification letter. We did not read the letter, DreamHost's own incident page, or any independent analysis, and we have no visibility into DreamHost's systems. The two-month figure is the report's reading of an August start and an October 23 discovery.
Five percent of this is wrong somewhere. It always is. Customer counts and the vulnerability name, when they come, will change the picture.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.