DreamHost Discloses Two-Month Breach That Compromised FTP Credentials and Webmail Sessions

DreamHost, a major web‑hosting provider, has alerted its customers to a security incident in which attackers infiltrated the company's File Manager platform for an estimated two months, gaining access to FTP and SFTP usernames and passwords as well as webmail session data.

The intrusion was uncovered during internal monitoring, prompting DreamHost to issue a public warning and recommend that all affected users change their login credentials immediately. The compromised information includes credentials that allow direct access to website files and email accounts, raising concerns about potential site defacement, data theft, or further exploitation.

DreamHost said the attackers entered the File Manager service—a tool that lets customers upload, edit, and manage website files—by exploiting an undisclosed vulnerability. Once inside, the threat actors were able to harvest authentication details stored within the platform. The company has not disclosed the number of customers impacted, but it confirmed that the breach was limited to the file‑management interface and did not extend to core server infrastructure or customer billing data.

Industry experts note that FTP and SFTP credentials are particularly valuable to cybercriminals because they provide low‑level access to a site’s code and content. When combined with webmail session data, attackers can also intercept communications or impersonate legitimate users. Security analysts advise hosting customers to adopt strong, unique passwords and enable two‑factor authentication wherever possible, as well as to rotate credentials regularly.

DreamHost has initiated a forensic investigation in collaboration with external cybersecurity firms to determine the exact attack vector and to assess any additional exposure. The firm also plans to strengthen its security controls, including tighter monitoring of privileged access and enhanced encryption for stored credentials.

The breach adds to a growing list of recent incidents targeting web‑hosting platforms, underscoring the persistent threat landscape faced by providers that manage vast numbers of small‑ to medium‑size business websites. While DreamHost’s swift disclosure aligns with best practices for incident response, the episode serves as a reminder that even well‑established services remain vulnerable to sophisticated attacks.

Customers are urged to review any recent activity on their sites, verify the integrity of uploaded files, and watch for unusual email behavior. DreamHost has pledged to keep users informed as the investigation progresses and to offer support for those who may need assistance securing their accounts.