DreamHost confirms two-month breach exposing customer FTP and SFTP credentials

What happened

DreamHost, a major web hosting provider, has confirmed a data breach in which attackers kept access to its File Manager platform for roughly two months. According to a security report on dev.to drawing on BleepingComputer's coverage, the intruders made off with customers' FTP and SFTP usernames and passwords, and active webmail sessions were also exposed.

The File Manager is the browser-based tool DreamHost customers use to work with files on their hosted sites, so the stolen credentials translate directly into the ability to alter those sites. DreamHost is reportedly notifying affected users.

What the attackers obtained

Two categories of exposure stand out for anyone running a site on the platform.

The first is FTP and SFTP logins, which are the everyday keys for site management. With a valid pair, an attacker can edit source code, plant malicious scripts — the report points to payment-card skimmers as a typical payload — or delete entire directories outright.

The second is webmail sessions. A hijacked session token lets an attacker occupy a mailbox without logging in again, which sidesteps multi-factor authentication entirely. From there they can read sensitive correspondence and intercept password-reset links, potentially turning one compromised mailbox into account takeovers across unrelated services.

Why the two-month window matters

The duration is arguably the most worrying detail. A two-month dwell time means intruders had ample opportunity to make changes inside hosted environments, and the report notes that such modifications may have slipped past standard monitoring tools. Subtle code injections, unlike obvious defacements, can sit undetected for a long time.

Confirmed versus unknown

The report separates what is established from what is still open. Confirmed: DreamHost has acknowledged the breach, the File Manager platform was the target, unauthorized access lasted approximately two months, and notifications to users are underway.

Still unknown: how many accounts were affected, how the attackers first got into the File Manager — for example a zero-day vulnerability versus stolen internal administrative credentials are both raised as possibilities — and how many hosted sites, if any, were actually modified using the stolen credentials.

Part of a broader wave

The dev.to report frames the incident alongside other recent infrastructure and supply-chain compromises. BleepingComputer also reported that the update infrastructure for cPGuard, a server security suite, was hijacked to distribute a backdoor and data-stealing scripts, and that developer platform WorkOS disclosed a breach in which a threat actor used a tool referred to as ARTEX AI to reach internal sales applications and summaries of customer communications.

Steps for affected customers

For developers and administrators with sites on DreamHost, the report recommends immediate action:

• Rotate all FTP, SFTP and SSH passwords, and change any instances where the same passwords are reused elsewhere.
• Audit file integrity by comparing production files against a known-clean baseline, for example via Git, to catch anything injected during the two-month window.
• Log out of all active webmail sessions to invalidate any hijacked tokens.
• Review access logs for unfamiliar IP addresses and unauthorized file modifications.

Why it matters

Hosting credentials are effectively the master keys to production code, and this breach put them in attackers' hands for two months. That means any affected site could have been silently altered — with skimmers, backdoors or worse — and those changes could still be live today. The webmail exposure compounds the damage, since a hijacked session defeats MFA and password resets, letting the intrusion spill beyond hosting into email-linked accounts everywhere. With the number of affected accounts and the initial entry vector still undisclosed, prudence says affected customers should assume exposure, rotate credentials, and verify their files against a clean state. The incident also lands amid a cluster of attacks on hosting and developer infrastructure, a reminder that the tools providers use to manage systems are themselves high-value attack surface.