DreamHost File Manager Breach Exposes FTP, SFTP and Webmail Credentials

En bref

• DreamHost's File Manager was reached by an unidentified party.
• FTP and SFTP login secrets plus webmail sessions were exposed.
• The intrusion window lasted roughly eight weeks.
• No CVE is tied to the incident; credential rotation is the priority.

DreamHost has disclosed that its File Manager component was reached by an unidentified party, and that the intruders removed authentication material rather than only viewing files. The data included login details for FTP and SFTP services as well as active webmail sessions. The activity is said to have continued for about two months, giving the intruders a long window to collect and potentially reuse what they found. No CVE has been assigned, which means this is not a software vulnerability with a patch number; it is a credential-compromise event.

The direct victims are DreamHost customers who rely on the File Manager, including any school or district accounts hosted with the provider. Because FTP and SFTP credentials often grant direct file access, and webmail sessions can bypass a fresh login prompt, the exposure raises the risk of website defacement, data theft, mailbox takeover, and follow-on phishing. For K-12 environments, those outcomes can affect public-facing sites, staff communications, and student data handled by third parties.

The absence of a CVE does not reduce urgency. Credential theft is often used later, after initial attention fades, to log in from unfamiliar locations or to move into connected systems. A two-month dwell time also means logs may contain earlier signs that were not reviewed. Organizations should treat any DreamHost-hosted account that used File Manager during the window as potentially compromised until credentials and sessions are rotated.

What to watch: repeated failed logins followed by success, FTP/SFTP connections from new IP ranges, webmail access at odd hours, newly created mail forwarding rules, and changes to hosted files. Administrators should also watch for password-spray attempts against related services where users reused the same credentials. The key response is containment through rotation and session invalidation, not waiting for a vendor patch.

À faire maintenant

1. Rotate all FTP and SFTP passwords and SSH keys for DreamHost accounts, then invalidate any active sessions tied to those credentials.
2. Force sign-out of webmail sessions, reset affected mailbox passwords, and enable multi-factor authentication where supported.
3. Review File Manager, FTP/SFTP, and webmail logs for at least the past 60 days for unusual source IPs, times, or file activity.
4. Audit DreamHost accounts for shared, reused, or dormant credentials and remove accounts that no longer need access.
5. Disable plain FTP where possible, restrict SFTP access by allowlist, and move to key-based authentication.
6. Check hosted sites and mailboxes for unauthorized files, forwarding rules, auto-replies, or configuration changes.
7. Notify affected users and the security team, and monitor for credential-stuffing attempts against related services.

Source originale

BleepingComputer