DreamHost data breach exposing FTP logins and webmail sessions

Tier B · Patch this week – Put it in the sprint

Who’s exposed: DreamHost customers using FTP/SFTP and webmail

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed

The Brief

DreamHost warned of a data breach after attackers accessed its File Manager platform for two months.
Attackers stole customers' FTP/SFTP usernames and passwords.
The headline also reports that webmail sessions were exposed.

If you host sites or files with DreamHost, your FTP/SFTP credentials may have been stolen and should be treated as compromised.

Checklist · 3 of 10 yes

Yes	Hits tech teams	Web hosting service whose File Manager and FTP/SFTP access developers and ops teams use.
No	Core infrastructure	Single hosting company's platform, not software nearly every team runs.
No	Popular tool	Hosting vendor's internal platform, not a widely used framework, tool or package.
Yes	Exploited in the wild	BleepingComputer: attackers gained access to File Manager platform for two months.
No	Public exploit	Neither source mentions published exploit code or proof-of-concept.
No	Remote, no login	Neither source states the initial access method or that no credentials were needed.
No	Full takeover	Sources report stolen credentials and sessions, not stated RCE, root or admin takeover.
Yes	Secrets exposed	BleepingComputer: attackers stole customers' FTP/SFTP usernames and passwords.
No	Supply chain	No source reports malicious code shipped through a trusted package or update channel.
No	No fix yet	Neither source says a fix is missing or incomplete.

First seen 2d ago · 2 sources · Full story page · How tiers are decided