DreamHost file manager breach exposes customer credentials
An attacker exploited DreamHost’s web-based file manager from August to 23 October to steal customers’ FTP and SFTP usernames and passwords. Some webmail credentials and sessions were also exposed, and email contents may have been accessed in a small number of accounts. The company confirmed the breach and warned customers, stating that far fewer than 10% of all email and file transfer accounts were affected.
Key facts
- Affected organisation
- DreamHost
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Exposure of credentials and other data for far fewer than 10% of all email and file transfer accounts
- Cause / method
- Credential theft through exploitation of the web-based file manager
- Location
- United States
If your data was exposed
Exposed dataUsernamePassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- This marked the stated end of the theft of customers’ FTP and SFTP usernames and passwords that had continued since August.
- The exposure of customer passwords and email contents, along with a related litigation investigation, became known.
- DreamHost confirmed the breach and stated that far fewer than 10% of all accounts were affected.
9 related reports
- DreamHost Data Breach Exposes Passwords and Email Contents
- DreamHost Data Breach Lawsuit Investigation
- DreamHost称数据泄露暴露了FTP凭据，并可能波及网页邮箱会话
- DreamHost Confirms Data Breach – Hackers Stole Customer Credentials and Accessed Emails
- DreamHost Breach Exposed FTP Passwords and Webmail Sessions for Two Months
- DreamHost confirms data breach exposed FTP logins and webmail sessions
- Hackers stole DreamHost customer files and inboxes during months-long attack
- DreamHost admits major cyberattack saw hackers steal customer data and access inboxes
- ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.