DreamHost Reports Data Breach Affecting FTP Logins and Webmail Sessions

DreamHost has reported a data breach that exposed customers’ FTP/SFTP usernames and passwords after attackers accessed its File Manager platform for two months. The breach occurred from August 2026 until it was discovered on October 23, 2026.

The American web hosting provider and domain registrar announced the incident, which necessitated users to reset their email and FTP/SFTP passwords. In a notification, DreamHost stated that an unauthorized third party exploited a vulnerability in the software running its web-based File Manager at files.dreamhost.com.

According to the notification, the attackers accessed FTP/SFTP usernames and passwords of individuals who logged into the File Manager during the breach period. Additionally, DreamHost indicated that the intruder may have accessed webmail systems, exposing session information, including credentials, for a limited number of users.

DreamHost described the attack as deliberate and confirmed that its staff has been working continuously to fully contain the situation. The company has found no evidence that the attacker accessed control panel login information or customer billing/payment details, which are managed by an external provider.

To mitigate the situation, DreamHost has blocked the attackers’ access and addressed the vulnerability that was exploited. The company also terminated active sessions for potentially affected users and invalidated their passwords.

Despite multiple inquiries from BleepingComputer regarding the incident and the number of impacted accounts, DreamHost has not provided a response. Users receiving the notifications are advised to check their website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where they may have used the same credentials.

To help mitigate risks from this exposure, DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax. Recipients of the notifications are also encouraged to consider placing a fraud alert or requesting a security freeze on their credit report.

Source: BleepingComputer