The Challenge
Attackers accessed DreamHost's web-based File Manager for about two months. They entered around August 2026, and the breach was discovered on October 23, 2026. During this time, anyone logging into the File Manager at files.dreamhost.com had their FTP/SFTP usernames and passwords exposed. The intruders may have also accessed webmail systems, exposing session information, including credentials, for some users.
The attack was deliberate, exploiting a vulnerability in the File Manager server software. This raises two key questions for your team: How can a flaw on one internet-facing server go unnoticed for so long? And once detected, what actions can maintain customer trust?
The Environment and Constraints
A hosting provider's File Manager is a prime target. It handles customer credentials for FTP/SFTP, which are used to manage website files. Stolen credentials can lead to unauthorized site changes, so customers are advised to check their website files for any alterations.
Several factors influenced the response:
- Credential Reuse: Customers might use the same password elsewhere, extending the risk beyond DreamHost's systems.
- Session Persistence: Webmail session data remains usable until sessions are terminated, so a password reset alone isn't enough.
- Separation of Sensitive Data: Billing and payment details are managed by an external provider. DreamHost found no evidence these were compromised, limiting the breach's impact.
- Unknown Scale: The number of affected accounts hasn't been disclosed, and the company hasn't responded to press inquiries.
The Approach Taken
The response focused on containment:
- Block the attacker's access and fix the vulnerability.
- Terminate active sessions for affected users and invalidate their passwords, requiring re-authentication.
- Notify affected users with specific steps: check website files, review webmail settings, and change reused passwords.
- Offer remediation support. Affected users receive a year of credit monitoring and identity theft protection through Equifax, with advice to consider a fraud alert or security freeze on their credit report.
Key details include session termination alongside password invalidation and guidance on checking webmail forwarding rules, which can prevent attackers from maintaining access.
Results and Metrics
Confirmed outcomes include blocking access, addressing the vulnerability, stopping sessions, and invalidating passwords. There's no evidence of access to control panel logins or billing details. Affected users were offered credit monitoring and identity theft protection.
However, significant unknowns remain: the exact duration of the breach, the number of affected accounts, and how the intrusion was detected. These are critical questions for customers, regulators, and insurers.
What They Would Do Differently
While DreamHost's internal conclusions aren't public, we can analyze the situation:
Shorten Dwell Time: A two-month breach indicates a monitoring gap. Under the NIST CSF Core Functions, detecting anomalous access patterns and unusual file activity is essential.
Treat the Vulnerability as a Program Failure: Regular scanning of internet-facing tools and timely patching are crucial. Identify which web-facing utilities might be overlooked in patch cycles.
Address the Scale Question Early: Even providing a range or reason for withholding information is better than silence, which can be perceived as ignorance or evasion.
Takeaways for Your Team
Measure Dwell Time, Not Just Response Time: Track both your incident response and exposure times. Test your detection capabilities for credential-harvesting activities.
Inventory Credential-Handling Systems: Ensure tighter logging and faster patching for file transfer tools, webmail, and admin portals.
Include Session Invalidation in Your Playbook: Password resets should be accompanied by session termination. Include both in your containment checklist.
Give Customers a Job to Do: Provide specific instructions to reduce risk, such as checking files and reviewing mail settings.
Know Your Coverage Triggers: Confirm when to notify your insurer and whether consent is needed before engaging vendors like credit monitoring providers. Check if breach notification timelines start at discovery.
Plan for the Long Term: One year of credit monitoring is standard, but stolen credentials can be used later. Communicate what customers should monitor after the offer ends.
