DreamHost says attackers exploited an unspecified File Manager vulnerability in an intrusion that began in August, accessing customer files and emails and obtaining FTP/SFTP credentials and webmail session tokens.
A session token is temporary proof that someone has already signed in; whoever holds it may enter as that user without the password. Stolen FTP/SFTP credentials could also provide access to hosted files, so the exposure reaches beyond content in DreamHost’s file manager.
DreamHost says the affected customer count is “well under 10%” but gave no precise figure. For organizations hosting sites or mail with DreamHost, the stolen access could extend the breach into files and inboxes, while the disclosure leaves which accounts were exposed—and for how long—unclear.
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.