Overview
- An attacker exploited a flaw in DreamHost’s web-based File Manager to collect FTP and SFTP usernames and passwords for users who logged into the service during the exposure period.
- DreamHost says the intruder may also have accessed webmail session information for a limited set of users, which could allow mailbox takeover or malicious forwarding rules.
- The company says it blocked the attacker, patched the File Manager, stopped active sessions, invalidated affected passwords and forced users to reset credentials while restoring services.
- DreamHost is offering one year of Equifax credit monitoring to notified individuals and is urging customers to inspect site files, review mail forwarding rules, and change any reused passwords.
- The firm has not disclosed how many accounts were affected and has not answered detailed media questions, leaving customers uncertain and increasing calls for clearer host disclosure and follow-up audits.