If your website lives on DreamHost and you ever logged into its browser-based File Manager between about August and 23 October, treat your FTP and SFTP passwords as stolen. The hosting company says an attacker got into the server behind the tool and read the usernames and passwords of people who signed in through it.
DreamHost puts the damage at well under 10% of its email and FTP/SFTP accounts. It says it has found no sign that control panel logins or billing details were reached, and that it does not store full card numbers.
The company found the intrusion on the afternoon of 23 October, took the File Manager servers offline and reset passwords for the mailboxes and FTP users it thought were exposed. In its incident notice, DreamHost calls it a deliberate attack made through a flaw in third-party software, without naming the software or giving a CVE number. The same intruder got into some webmail systems too and lifted the logins of a few webmail users. DreamHost suspects a handful of those logins were used to read inboxes, and says it is writing to those customers individually.
For most people the visible effect was a lockout. Accounts that were reset stay locked until the person who owns the DreamHost account picks a new password in the control panel; nobody else can do it for them. BleepingComputer reported that DreamHost first described the problem as File Manager connection trouble, and that customers complained about getting reset emails with no explanation. BleepingComputer, citing DreamHost’s own page, says the host serves more than 400,000 customers across over 100 countries.
The File Manager is back online after a rebuild with added monitoring. DreamHost also swapped its own internal keys that might have leaked and brought in outside forensic investigators. It says it is reviewing its other customer-facing tools for similar flaws and notifying regulators.
What to do now: set unique passwords for every email and FTP/SFTP user on the account, and change any other account that shared an old DreamHost password. Update the passwords saved in mail and file-transfer apps, look through your site files for changes you did not make, and check webmail forwarding rules and filters for anything you did not add. DreamHost also warns of copycat scam emails: its incident emails never ask for a password or a sign-in through a link, so type panel.dreamhost.com into the browser yourself.
DreamHost says its investigation is continuing and that it will publish further developments. It has not said how many accounts were affected or what the vulnerable software was.
