DreamHost says attackers spent two months in File Manager stealing FTP credentials and session tokens

Attackers held access from August to late October

DreamHost has confirmed that intruders were present inside its web-based File Manager from August until October 23, roughly two months of access before the activity was noticed. According to TechCrunch, whose reporting was summarised in a dev.to write-up, the attackers used that foothold to steal FTP and SFTP credentials belonging to customers, along with some of the session tokens used for webmail.

What was exposed

File Manager is the browser-based tool DreamHost provides for managing files on hosted accounts, which makes it a sensitive piece of the customer environment. The exposure falls into two categories: FTP and SFTP logins, which grant file-level access to customers' web servers, and a subset of webmail session tokens. The reporting describes the token theft as affecting some accounts, though the precise scope is not quantified in the material available.

Why the tokens matter as much as the passwords

Stolen passwords are serious but familiar: they can be rotated, and multi-factor authentication blunts their value. A stolen session token is a different problem. A token is what a mail service hands to a browser after a successful login, and presenting a valid token generally skips the login step entirely, password and, in many setups, second factor included. That means a password change alone may not end an attacker's access to a mailbox; active sessions may need to be explicitly invalidated, for example by signing out of all devices.

Recommended steps for affected customers

The write-up sets out a short checklist for anyone who hosts with DreamHost, or supports clients who do:

• Rotate FTP, SFTP and email passwords.
• Audit hosted sites for files that no one on the team placed there deliberately.
• Turn on multi-factor authentication wherever DreamHost offers it.
• Maintain independent backups rather than relying solely on the host's managed copies.
• Monitor your own logs, because a managed host does not remove the obligation to watch your own environment.

Why it matters

The headline number is the dwell time. Two months of continuous access to a file-management tool on a large managed host shows that even established providers can carry an active intrusion without catching it, and that leaving security entirely to the host is not a complete answer for anyone running production websites.

The specific data taken compounds the problem. FTP and SFTP credentials are a route to planting malware, defacements or persistence on customer sites, and mailbox access is a classic stepping stone to further account takeovers, since so many services still send password resets over email. Because people reuse passwords, the blast radius may also extend beyond DreamHost to wherever the same logins appear.

For the hosting industry, the incident is a reminder that web-based file-management interfaces, which sit authenticated in front of large numbers of customer servers, are high-value targets, and that session token theft deserves the same incident-response attention as credential exposure. For customers, the practical lesson is blunt: rotate credentials, end active sessions, verify file integrity, and never treat a managed host as a substitute for your own backups and monitoring.