DreamHost Reports Intrusion Exposing FTP, SFTP and Webmail Credentials
Summary
The article reports DreamHost confirmed an intrusion exploiting its web file manager, exposing FTP/SFTP credentials, session tokens and some webmail credentials. Activity reportedly lasted from August to October 23, 2026; DreamHost disabled the manager.
Key points
- The article says attackers exploited a vulnerability in DreamHost’s web-based file manager; it provides no CVE or vulnerability details.
- The article reports that attackers harvested customer FTP and SFTP credentials and intercepted active session tokens.
- It says credentials for some webmail users were obtained, and DreamHost contacted affected account holders.
- The reported activity began around August 2026 and continued until October 23, when DreamHost identified anomalous behavior and disabled the file manager.
- The article recommends rotating passwords and SFTP credentials, checking server files and webmail rules, and reviewing database privileges.
Article Details
- Victim Organization
- DreamHost
- Incident Type
- Exploitation of a vulnerability in DreamHost’s web-based file manager, followed by credential and session-token theft and unauthorized access to webmail environments.
- Data Types Exposed
- FTP and SFTP credentials
- Webmail login credentials
- Active session tokens
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The intrusion reportedly affected multiple server clusters. DreamHost deactivated the file manager after anomalous behavior was identified on 2026-10-23 and contacted impacted account holders. The article describes potential website and email risks, but does not confirm website tampering or service disruption.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe article says attackers used stolen credentials and active session tokens to impersonate legitimate website administrators.T1190 · Exploit Public-Facing ApplicationThe article says attackers exploited an application vulnerability in DreamHost’s web-based file manager to infiltrate host server processes.