The notice identifies another access path

DreamHost’s breach notice filed with California authorities describes possible exposure of webmail session information as well as FTP/SFTP usernames and passwords. The notice identifies an approximate August–October 23 access window involving its browser-based File Manager and says email contents and files may also have been accessed. Those statements describe potential exposure, not proof that every customer’s files were copied.

Containment and scope remain different questions

In its October 29 public account, DreamHost says an attacker exploited third-party software used by File Manager. It reports password resets, terminated sessions and a rebuilt service, with outside specialists assisting the investigation. The company says it has found no evidence of access to control-panel credentials or customer billing details. It also cautions that precautionary reset notices went to some users who may not ultimately have been affected.

The small-business consequence

For a small business using hosted mail and website files, restored access is only one part of the incident’s significance. The more consequential scoping question is what the affected mailbox or file account held: customer correspondence, operational documents or credentials that could open another service. DreamHost’s notice expressly asks recipients to consider those contents when deciding which other accounts need review. Its public guidance also calls for checking unexpected website changes and unfamiliar mail forwarding rules or filters. That is a materially different review from confirming a new password works. Customers need their own account evidence and the provider’s findings before deciding the extent of downstream exposure; the public notice does not establish a uniform outcome for every business.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Small business
Suggest a correction →