DreamHost confirms attackers exploited its web File Manager from about August to Oct 23, stealing FTP/SFTP logins and some webmail sessions
- If you host there: assume any password typed into files.dreamhost.com since August is burned. Rotate it (and anywhere you reused it), check site files for unexpected changes or web shells, and remove unknown mail forwarding rules and filters, as DreamHost advises.
- DreamHost says it fixed the vulnerability, ended active sessions and reset passwords. It is offering one year of credit monitoring.
- Not disclosed: how many accounts were affected and what the File Manager vulnerability was.
Sources: DreamHost Notice of Data Breach (letter filed with California AG) · BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions (Nov 4)