DreamHost has disclosed a security incident involving its File Manager platform, saying attackers had access for roughly two months and obtained customer FTP and SFTP usernames and passwords. According to the report, webmail session information was also exposed. The incident matters beyond one hosting provider because many small and medium-sized businesses depend on hosting control panels and web-based admin tools to manage websites, files, email and backups.

What happened

According to DreamHost's disclosure as reported by BleepingComputer, attackers gained unauthorized access to the company's File Manager platform over an extended period and exfiltrated customer data. The exposed information reportedly included FTP and SFTP usernames and passwords, along with webmail session details.

At this stage, the confirmed point is that DreamHost has acknowledged the breach and the types of data involved. Businesses should distinguish between the confirmed exposure of credentials and any later investigation into whether those credentials were subsequently used in other attacks.

Why it matters for European businesses

For European companies, especially SMEs using hosted websites, the practical risk is not limited to a single account. FTP and SFTP credentials can provide direct access to website files, application code, uploaded content and configuration files. In some environments, that can enable website defacement, malware injection, SEO spam, data theft or further compromise of connected services.

Exposure of webmail session information can also increase the risk of account misuse if sessions were still valid at the time of the incident. Business email remains a common entry point for invoice fraud, phishing and account recovery abuse, so any compromise touching email administration or active sessions should be treated seriously.

This is also a broader supply-chain style reminder: when a hosting provider or web administration tool is compromised, customer businesses may face downstream risk even if their own internal systems were not directly breached.

Who may be affected

The businesses most likely to be affected are those using DreamHost hosting services and its File Manager or related website administration features. The impact may be higher for companies that:

• store live website files on hosted accounts managed through FTP or SFTP,
• use the same credentials across multiple systems or environments,
• have limited monitoring for website file changes,
• manage business email through the same hosting provider,
• depend on agencies or freelancers who share access to hosting accounts.

European e-commerce operators and lead-generation websites should pay particular attention because any unauthorized change to web content, checkout flows, forms or scripts can affect revenue, customer trust and compliance obligations.

What companies should consider

Businesses using DreamHost should review the provider's guidance and verify whether their accounts were impacted. As a practical response, companies should consider:

• Rotating FTP and SFTP credentials immediately and avoiding credential reuse across staging, production and third-party tools.
• Reviewing webmail and hosting account sessions, logging out active sessions where possible and changing related passwords.
• Checking website files for unauthorized changes, including modified templates, injected scripts, newly added admin files or unusual scheduled tasks.
• Reviewing access logs for unexpected logins, unusual file transfers or access from unfamiliar IP addresses.
• Ensuring multi-factor authentication is enabled on hosting, email and domain administration accounts where available.
• Separating privileges so agencies, developers and internal staff only have the minimum access needed.
• Reviewing incident response and backup readiness in case site restoration or forensic review becomes necessary.

For SMEs, the key lesson is that website hosting credentials should be treated like business-critical infrastructure credentials, not just routine admin logins. A compromise at the hosting layer can quickly turn into a website outage, malware incident, email misuse or customer trust problem.