DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost has disclosed that attackers exploited a vulnerability in its File Manager platform to steal customers' FTP/SFTP usernames and passwords over a two-month period ending in October 2026. The web hosting provider says no billing information or control panel logins were compromised, and it is offering affected users credit monitoring.
BleepingComputer
DreamHost is warning customers of a data breach after unauthorized attackers accessed its web-based File Manager platform for roughly two months and stole FTP/SFTP usernames and passwords.
The American web hosting provider and domain registrar previously announced a cybersecurity incident that required users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.
According to the notification, the company discovered that an unauthorized third party accessed the server that runs its web-based File Manager at files.dreamhost.com. The intruder exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into the File Manager during the exposure window.
DreamHost also said the intruder may have accessed webmail systems, exposing session information, including credentials, for a limited number of users. The company described the attack as appearing deliberate and said its staff has been working continuously to contain it.
At this time, DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing and payment details, which are handled by an external provider. The company said it has blocked the attackers' access, addressed the exploited vulnerability, stopped active sessions for potentially affected users, and invalidated passwords.
BleepingComputer reported that it contacted DreamHost multiple times with questions about the incident and the exact number of impacted accounts but received no response.
Recipients of the breach notifications are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where the same credentials may have been reused.
To mitigate risks from the exposure, DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax. Letter recipients are also urged to consider placing a fraud alert or requesting a security freeze on their credit report.