DreamHost breach exposes FTP credentials

The web hosting provider DreamHost has confirmed that an attacker spent roughly two months inside the server behind its browser-based File Manager, walking away with FTP/SFTP usernames and passwords. The intrusion touched a tool customers use routinely, and the stolen credentials could open doors well beyond the hosting account itself.

The company's account, laid out in a data breach notification, describes access stretching from approximately August 2026 to October 23, 2026 — the day the activity was discovered. DreamHost has not said how the discovery came about.

What the notification says happened

In the notification, DreamHost states that an unauthorized third party accessed the server running its File Manager at files.dreamhost.com. According to the notification, the attacker exploited a vulnerability in that software to reach the FTP/SFTP usernames and passwords of people who logged into the File Manager between approximately August 2026 and October 23, 2026.

"We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com,"

— DreamHost, in its data breach notification

The same notification carries the company's description of how the credentials were taken:

"The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."

— DreamHost, in its data breach notification

DreamHost has not publicly named the vulnerability, assigned it a CVE identifier, or described the technical mechanism beyond the phrase "a vulnerability in that software."

The webmail angle draws a wider circle

File Manager credentials are not the only concern. DreamHost says the intruder may also have accessed webmail systems, exposing session information — including credentials — for a limited number of users. That extends the potential impact past people who logged into the File Manager during the window, though the company has characterized the webmail exposure as limited.

Session information matters because it can allow an attacker to act inside an already-authenticated mailbox without ever knowing the account password. DreamHost says it stopped active sessions for potentially affected users and invalidated passwords, steps aimed at cutting off any lingering access.

What DreamHost says was not touched

The company says it has found no evidence that the attacker reached control panel login information or customer billing and payment details. Payment data, per the notification, is handled by an external provider.

DreamHost also says it has blocked the attackers' access and addressed the vulnerability that was exploited. The firm described the attack as deliberate and said its staff has been working nonstop to contain it fully.

BleepingComputer reported that it contacted DreamHost multiple times with questions about the incident and the exact number of impacted accounts, and that those inquiries went unanswered. That leaves the scale of the exposure — how many customers, how many webmail accounts — without a public figure.

A timeline measured in months

The dates in the notification are the clearest measure of the incident's scope. Access began around August 2026 and continued until October 23, 2026. Credentials captured at any point in that stretch would have been valid at the moment of capture, and would remain useful to an attacker anywhere those same credentials were reused.

• August 2026 — approximate start of the unauthorized access window
• October 23, 2026 — the day the access was discovered
• One year — length of credit monitoring and identity theft protection offered through Equifax

The notification does not say how many customers fall inside that window, and DreamHost has not provided a count.

The advice sent to affected customers

Recipients of the notifications are directed to take several concrete steps. DreamHost advises checking website files for unauthorized changes, reviewing webmail forwarding rules and filters, and changing passwords on any other accounts where the same credentials may have been used.

Forwarding rules and filters deserve particular attention in a webmail compromise, since they can be used to quietly redirect or suppress messages without the account holder noticing. Checking website files serves a similar purpose on the hosting side — looking for modifications that shouldn't be there.

The company is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax. Letter recipients are also urged to consider placing a fraud alert or requesting a security freeze on their credit report.

An earlier warning, and what changed

The confirmation follows DreamHost's earlier announcement that it had suffered a cybersecurity incident that required users to reset their email and FTP/SFTP passwords. That step — forcing resets — was the company's first public signal that credentials were at risk.

The breach notification adds detail that the earlier announcement did not: the entry point at files.dreamhost.com, the exploit of a software vulnerability there, the August-to-October window, and the possible webmail session exposure.

What remains unstated is just as notable. DreamHost has not said how many accounts were affected, has not identified the vulnerability by name or CVE, and has not described how the intrusion was detected. The company has also not said whether it found signs that stolen credentials were used against customer sites.

Where the risk lands for customers

For anyone who logged into DreamHost's File Manager during the exposed period, the practical exposure is a set of FTP/SFTP credentials in someone else's hands. Those credentials may also have been reused on other services, which is why the notification asks recipients to change passwords wherever the same login was used.

The webmail exposure adds a second front. Session information, including credentials, for a limited number of users means those mailboxes could have been reachable without a password. Reviewing forwarding rules and filters is the check DreamHost recommends for exactly that reason.

The company's own containment steps — blocking access, patching the vulnerability, ending active sessions, invalidating passwords — are described in the notification as complete. What the notification does not provide is a count of affected accounts, a named flaw, or an account of how the activity was caught on October 23, 2026.

Customers who received a letter have a defined set of actions available: inspect site files, audit webmail rules, rotate reused passwords, and decide whether to take up the Equifax offering or place a fraud alert or credit freeze. Those who did not receive a letter but logged into files.dreamhost.com during the window have no direct confirmation from the company about their status.

Why this matters beyond one host

The DreamHost case turns on a supporting tool rather than the main control panel. File Manager sits beside the hosting account, and the credentials it handled reached into FTP/SFTP — a protocol many site owners set up once and rarely revisit. That pattern suggests the blast radius of a compromise can extend past the system that was actually breached, particularly where passwords are reused across services.

The absence of a public account count also leaves customers to judge their own exposure. Until DreamHost provides figures, the safest reading for anyone inside the August-to-October window is that their credentials should be treated as compromised — which is what the company's reset and session-invalidation steps already imply. The offering of credit monitoring through Equifax points to the same conclusion: DreamHost is acting as though the data is out.