DreamHost confirms data breach exposed FTP logins and webmail sessions

What it is

DreamHost, a US web host and domain registrar, said an attacker exploited a vulnerability in the software behind its web-based File Manager at files.dreamhost.com. The intrusion ran from about August 2026 until 23 October 2026, the day DreamHost discovered it. The page does not name the vulnerability. DreamHost calls the attack deliberate.

Preconditions / Affected

Exposed FTP/SFTP credentials belong to people who logged into the File Manager during that window. Using SFTP with a separate client would not, on the page's wording, put an account in scope. Webmail session data, including credentials, may be exposed for "a limited number of users". DreamHost has not said how many accounts are affected, and BleepingComputer's repeated questions went unanswered.

What to do

• Check website files for unauthorized changes. Stolen FTP/SFTP access lets an attacker modify hosted content.
• Review webmail forwarding rules and filters for entries you did not create.
• Change passwords on any other account that reuses the exposed credentials.
• Consider a fraud alert or a security freeze on your credit report. DreamHost's letter recommends this and offers one year of Equifax credit monitoring and identity theft protection.

DreamHost has already blocked the attacker, patched the flaw, ended active sessions for potentially affected users and invalidated their passwords.

Caveats

DreamHost says it found no evidence that control panel login information or billing and payment details were accessed. An external provider handles billing. This is a statement of no evidence found, not a confirmed exclusion, and the investigation is still containing the incident. The exact start date within August 2026 is not given.