Overview
Web host DreamHost has confirmed a data breach in which attackers gained access to the server running its web-based File Manager and stole customers' FTP/SFTP usernames and passwords. The intruder had access from roughly August 2026 until October 23, 2026, when DreamHost discovered the intrusion. The company had already forced password resets in an ongoing incident late last month.
What Was Exposed
- FTP/SFTP usernames and passwords of users who logged into File Manager during the window.
- Webmail session information, including credentials, for a limited number of users. The attacker may have accessed the webmail systems.
DreamHost says it found no evidence that control panel logins or customer billing and payment details were accessed. Payments are handled by an external provider. The company has not said how many accounts are affected, and did not answer BleepingComputer's requests for a number.
The attackers exploited a vulnerability in the File Manager software.
DreamHost's Response
- Blocked the attacker's access and fixed the exploited vulnerability
- Ended active sessions for potentially affected users and invalidated their passwords
- Required email and FTP/SFTP password resets
- Offered affected individuals one year of credit monitoring and identity theft protection through Equifax
Recommended Actions for Customers
- Check website files for unauthorized changes. Stolen FTP credentials can be used to plant web shells or inject malicious code.
- Review webmail forwarding rules and filters for anything you did not create.
- Change passwords on any other accounts where the same credentials were used, and use unique passwords per service.
- Consider a fraud alert or credit freeze if you were notified of exposure.
- Prefer key-based SFTP authentication where possible.
Sources
- BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions