DreamHost confirms File Manager breach exposed FTP/SFTP logins and webmail sessions

TLDR

• DreamHost says an intruder exploited a flaw in its File Manager to capture FTP/SFTP logins until 23 October 2026.²
• Webmail session data of a limited number of users may also have been exposed, DreamHost says.²
• DreamHost says well under 10 per cent of accounts were affected; no evidence that billing or panel logins were reached.²

Web host DreamHost has confirmed a data breach in which attackers captured customers' FTP/SFTP usernames and passwords, and BleepingComputer reports they were inside its File Manager for about two months.¹ In a notice dated 29 October 2026, DreamHost says an unauthorised party accessed the server that runs its web-based File Manager at files.dreamhost.com, which runs on third-party software.² It says the intruder exploited a flaw in that software to capture FTP/SFTP credentials of people who logged in to File Manager before detection on the afternoon of Friday 23 October.² DreamHost's data breach notice letter puts the activity between August 2026 and 23 October 2026, and says the credentials captured were those of people who logged in between approximately August 2026 and 23 October 2026.⁵

The intruder also reached some webmail systems, DreamHost says, which took login details for a limited number of webmail users.² Those passwords were reset and active sessions ended, and in a small number of cases the intruder may have used the credentials to read mailbox contents, with those customers being contacted individually.² The notice letter adds that the contents of email and files on the FTP/SFTP server may also have been accessed.⁵ TechCrunch reports that the attackers obtained session tokens, which keep users logged in after they enter a password, and that the breach notice filed with California's attorney general says the intrusion started in August.³ DreamHost calls it a deliberate attack and says that, so far, it has found no evidence that control panel logins or billing details were accessed.²

TechCrunch reports that a spokesperson declined to explain why the attack was not detected earlier, citing the ongoing investigation, did not identify the vulnerability, and said it was unrelated to recently disclosed PHP flaws.³ SecurityWeek reported on 27 October that DreamHost had forced password resets for some email and FTP/SFTP users and that the root cause had not been disclosed.⁴ DreamHost says affected accounts are well under approximately 10 per cent of email and FTP/SFTP accounts, fewer than first thought.² TechCrunch reports a spokesperson gave "well under 10%" with no more precise figure, and BleepingComputer says DreamHost did not reply to its questions about the number of affected accounts.¹³ On duration, BleepingComputer says about two months, TechCrunch calls the attack months-long, and DreamHost gives only an approximate start of August 2026.¹²³

DreamHost says it took the compromised server out of service and preserved it for forensics, rebuilt File Manager with enhanced monitoring, rotated possibly exposed internal credentials and fixed the root-cause vulnerability.² It has retained outside security and forensics experts and is notifying regulators.² It advises affected users to reset passwords, check site files for unfamiliar changes and review webmail forwarding rules and filters.² BleepingComputer reports that affected individuals are offered one year of Equifax credit monitoring and identity theft protection.¹

Why it matters: stolen FTP/SFTP and webmail credentials can let an intruder reach customers' website files and mailboxes, which is why DreamHost tells affected users to check site files and forwarding rules.²