DreamHost breach: File Manager flaw exposed FTP/SFTP logins and webmail sessions

What happened

DreamHost, a US web hosting provider and domain registrar, disclosed a breach after an outage that spanned several days, during which it reset some customer passwords. TechCrunch reports the disclosure came “last Thursday” relative to its November 4, 2026 article; the exact date is not confirmed in the sources. TechCrunch

In its data breach notification, DreamHost says an unauthorized third party accessed the server that runs its web-based File Manager at files.dreamhost.com. The attacker exploited a vulnerability in that software and could access the FTP/SFTP usernames and passwords of people who logged into the File Manager between approximately August 2026 and October 23, 2026, the day the intrusion was discovered. BleepingComputer

DreamHost also says the intruder may have accessed webmail systems, exposing session information, including credentials, for a limited number of users. BleepingComputer In a notice filed with California’s attorney general, DreamHost said the attack began in August and let hackers obtain session tokens, which keep users logged in after they enter a password. A stolen token lets an attacker act as that user. TechCrunch

What DreamHost reports about its response and scope:

• DreamHost says the attack appears deliberate and that it has blocked the attackers’ access and addressed the exploited vulnerability. BleepingComputer
• It stopped active sessions for potentially affected users and invalidated their passwords. BleepingComputer
• It found no evidence that the attacker accessed control panel login information or customer billing and payment details, which an external provider handles. BleepingComputer
• A spokesperson told TechCrunch the number of affected customers is “well under 10%” but gave no precise figure. DreamHost touts some 400,000 paying customers. TechCrunch
• The company would not say what the vulnerability is or why it did not detect the attack sooner, citing an ongoing investigation. It said the flaw is unrelated to the vulnerabilities recently discovered in PHP web software. TechCrunch
• BleepingComputer’s questions about the exact number of impacted accounts went unanswered. BleepingComputer

Not confirmed: the vulnerability identifier or CVE, the specific software affected, the exact number of affected accounts, and the identity of the attacker.

Am I affected?

You are potentially affected if you are a DreamHost customer and either of these applies:

• You logged into the web-based File Manager at files.dreamhost.com between approximately August 2026 and October 23, 2026. Your FTP/SFTP username and password may have been exposed. BleepingComputer
• You are one of a limited number of webmail users whose session information, including credentials, may have been exposed. BleepingComputer

DreamHost is sending notifications to affected people. If you received one, treat it as applicable to you. If you did not, the sources do not say how to confirm your status, so contact DreamHost; this is not confirmed. DreamHost reports no evidence of control panel login or billing and payment data exposure. BleepingComputer

What to do now

1. Reset your FTP/SFTP and email passwords if you have not already. DreamHost invalidated passwords for potentially affected users, but you should still set new, unique ones. BleepingComputer
2. Check your website files for unauthorized changes, as DreamHost advises notification recipients to do. BleepingComputer
3. Review webmail forwarding rules and filters for anything you did not create. BleepingComputer
4. Change passwords on any other accounts where you reuse the same credentials. BleepingComputer
5. If you received a notification letter, consider the one year of credit monitoring and identity theft protection through Equifax that DreamHost is offering. Also consider placing a fraud alert or asking for a security freeze on your credit report. BleepingComputer
6. Watch for updates from DreamHost, since its investigation is ongoing and key details remain unconfirmed. TechCrunch

Sources

• BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions
• TechCrunch: Hackers stole DreamHost customer files and inboxes during months-long attack