US web host and domain registrar DreamHost is sending breach notifications: an unauthorized party exploited a vulnerability in the software that runs its web-based File Manager, files.dreamhost.com, and from August until October 23, the day the breach was discovered, obtained the usernames and passwords of people who logged in through it.
According to BleepingComputer, the company says the intruder may also have accessed webmail systems and exposed session information for a limited number of users. DreamHost found no evidence of access to control panel logins or payment details. It has not said how many accounts were affected.
The company blocked the access, fixed the flaw, ended active sessions and invalidated exposed passwords. Customers who received a notice should check their website files for unauthorized changes, review webmail forwarding rules and filters, and change the password on any other account where they used the same one.