DreamHost Confirms Two-Month Breach Exposing FTP/SFTP Credentials and Webmail Sessions
DreamHost, a US-based web hosting provider and domain registrar, has confirmed a data breach after attackers exploited a vulnerability in its web-based File Manager platform at files.dreamhost.com. The intrusion lasted from approximately August 2026 to October 23, 2026, when it was discovered, and allowed the unauthorized third party to steal FTP/SFTP usernames and passwords of users who logged into the File Manager during that window. The attacker may have also accessed webmail systems, exposing session information including credentials for a limited number of users. DreamHost states the attack appears deliberate and that it found no evidence of access to control panel logins or billing/payment data, which is handled by an external provider.
Detalhes técnicos
The attacker exploited a software vulnerability in the File Manager service to gain unauthorized server access, harvesting FTP/SFTP credentials entered by customers during the exposure period. Webmail session hijacking may have also occurred, giving the attacker access to session credentials for some users.
Remediação
DreamHost has blocked the attacker's access, patched the exploited vulnerability, terminated active sessions for potentially affected accounts, and invalidated passwords. Affected customers are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, change reused passwords on other accounts, and consider a credit freeze or fraud alert. DreamHost is offering one year of free credit monitoring and identity theft protection through Equifax.
Linha do tempo
-
DreamHost Confirms Two-Month Breach Exposing FTP/SFTP Credentials and Webmail Sessions
ler a análise desta fonte ocultar
DreamHost, a US-based web hosting provider and domain registrar, has confirmed a data breach after attackers exploited a vulnerability in its web-based File Manager platform at files.dreamhost.com. The intrusion lasted from approximately August 2026 to October 23, 2026, when it was discovered, and allowed the unauthorized third party to steal FTP/SFTP usernames and passwords of users who logged into the File Manager during that window. The attacker may have also accessed webmail systems, exposing session information including credentials for a limited number of users. DreamHost states the attack appears deliberate and that it found no evidence of access to control panel logins or billing/payment data, which is handled by an external provider.
Technical Details
The attacker exploited a software vulnerability in the File Manager service to gain unauthorized server access, harvesting FTP/SFTP credentials entered by customers during the exposure period. Webmail session hijacking may have also occurred, giving the attacker access to session credentials for some users.
Remediation
DreamHost has blocked the attacker's access, patched the exploited vulnerability, terminated active sessions for potentially affected accounts, and invalidated passwords. Affected customers are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, change reused passwords on other accounts, and consider a credit freeze or fraud alert. DreamHost is offering one year of free credit monitoring and identity theft protection through Equifax.