DreamHost Says Hackers Reached Customer Logins and Some Inboxes in a Months-Long Attack

Web hosting customers who used File Manager since August should reset mail and FTP passwords now.

Web host DreamHost has disclosed a breach that began in August and was found on October 23, according to TechCrunch. The company has about 400,000 paying customers, and a spokesperson told TechCrunch that the number affected is "well under 10%" without giving a precise figure. The attackers have not been identified.

DreamHost's own announcement says an attacker exploited a flaw in third-party software behind its web-based File Manager. That exposed FTP and SFTP usernames and passwords of people who logged in to File Manager before the activity was caught. The attacker also reached some webmail systems and, in a small number of cases, may have viewed mailbox contents. DreamHost says it found no evidence that control panel logins or billing details were accessed.

DreamHost took the affected servers offline, fixed the flaw and rebuilt File Manager with added safeguards. Its guidance is to treat FTP and SFTP credentials used in File Manager since August as compromised and to reset affected mail, FTP and SFTP passwords from the control panel. It also asks customers to change any reused passwords, update saved passwords in email and FTP programs, check website files for changes they did not make, and look for webmail forwarding rules they did not create.