DreamHost confirms data breach exposed FTP logins and webmail sessions
Summary
Web hosting provider DreamHost has confirmed a data breach that occurred between April and June 2024. Attackers gained access to the company's File Manager platform, stealing customer FTP/SFTP credentials and webmail session cookies.
IFF Assessment
FOE
This incident represents a loss of sensitive customer information and a compromise of hosting infrastructure, which is detrimental to defenders.
Defender Context
This breach highlights the ongoing risk of credential stuffing and session hijacking attacks against hosting providers. Defenders should be aware of the potential for compromised credentials to lead to further unauthorized access and should encourage customers to use strong, unique passwords and enable multi-factor authentication where possible.