Somewhere, someone typed an FTP password once, years ago, and never thought about it again. FTP and SFTP are ways of uploading files to a web server. Whoever built your website, or updates your pages, probably uses one. The login usually gets set up on a busy afternoon and then stays in place for years.
BleepingComputer reported that DreamHost, a web hosting company, confirmed a breach in which attackers got into its File Manager platform and stayed for two months. They stole customers’ FTP and SFTP usernames and passwords, and the report’s headline also mentions exposed webmail sessions. I’m not going to guess at the details beyond that. I’m more interested in what a notice like this costs the person who receives it, because the cost is rarely the dramatic part.
The first cost: finding out who holds the key
Say you’re a DreamHost customer and the email arrives. The instruction is simple: change your passwords. But to change an FTP password, you have to know where it’s used. Your web developer might have it saved in an upload tool. A marketing contractor might have it in a plugin. An old agency might still have a copy. Few small businesses have a list of who can log in to their website’s files, so the first hours go to asking around and piecing that list together. That time is real, and it comes out of whoever was already busiest.
The second cost: looking backward
The two-month window matters here. If someone had your login for that long, changing the password only stops future access. It doesn’t tell you what happened in the meantime. Someone has to ask whether any files on the site were changed, whether anything odd was added, and whether anything looks different from what the developer last published. Most small companies don’t have a clean record of ’what the site looked like in August’ to compare against. So the checking is slow and relies on judgment, and the answer is often ’probably fine’ rather than ’definitely fine.’ Living with that uncertainty costs attention for weeks.
The third cost: the reused password
This one tends to surprise people. A stolen password is only as dangerous as the other places it works. If the FTP password resembles the one on the email account, the domain registrar, or the payment processor, the cleanup grows from one login to a dozen. Nobody planned for that. It happened because reusing a password felt harmless at the time.
The fourth cost: the conversation with customers
If your website collects inquiries or sells things, you may eventually have to decide whether to tell customers anything. Whether you must is a question for your own advisor, and it depends on what the site holds and where your customers are. Even when nothing requires a message, you’ll want to be able to answer a customer who asks, calmly and specifically. ’We got a notice from our host, here’s what we checked, here’s what we changed’ is a good answer. ’We’re not sure’ is a harder one to give.
What this suggests
The breach wasn’t yours, and nothing on your side caused it. The part you control is how expensive the cleanup is when it happens. A short written list of who has access to your website and email, and a habit of using a different password for each service, turns a multi-week scramble into a few hours of work. That list takes about an hour to write, which is a small price compared with reconstructing it under pressure while a two-month window hangs over you.