DreamHost has confirmed that an attacker broke into the server behind its browser-based File Manager at files.dreamhost.com. The attacker stole the FTP/SFTP usernames and passwords of customers who logged into the tool between about August 2026 and October 23, 2026, the day DreamHost found the intrusion. The intruder also reached some of DreamHost's webmail systems and took login credentials or session data for what the company calls a "limited number" of webmail users. In a small number of cases DreamHost believes mailbox contents were viewed. DreamHost is a US web hosting provider and domain registrar. Its own website says it serves more than 400,000 customers in over 100 countries and hosts at least 1.5 million websites and applications. The company has not said how many accounts were affected. Its notice letter filed with the California Attorney General on November 2 gives no figure. webhosting.today reports that DreamHost's current analysis puts the affected share at "well under 10%" of its hosted email and FTP/SFTP accounts.
What Happened
On the afternoon of Friday, October 23, DreamHost found that an unauthorized third party had accessed the File Manager server. In its October 29 announcement, the company says it took the File Manager servers offline straight away, fixed the vulnerability and started an investigation.
The public story came out in stages. At first DreamHost described the problem only as "an issue" affecting File Manager and webmail. SecurityWeek and BleepingComputer reported that over the weekend of October 24 and 25, it forced password resets for some email and FTP/SFTP users. Affected users were locked out until the account owner set new credentials. Recovery instructions went out to account owners in batches, because DreamHost said it could not contact individual mailbox or FTP users directly. Customers complained publicly about the lack of explanation. Some speculated on Reddit about whether stored passwords had been properly hashed. By Monday, October 26, DreamHost said it had deployed a fix and restored File Manager access.
DreamHost's October 29 announcement confirmed a "deliberate attack." It also said fewer customers were known to be affected than first suspected, so not everyone who got the original reset email had actually been exposed. The formal breach notification, which BleepingComputer reported on November 4, gave the exposure window as roughly August 2026 to October 23. That is about two months of undetected access.
The timing details differ slightly between versions. The October 29 announcement only says users who logged in "before the activity was detected on October 23" were exposed, with no start date. The later notification letter gives the August start date.
What Was Taken
DreamHost and the coverage of its notices describe the following:
- FTP/SFTP usernames and passwords for anyone who logged into the web File Manager during the exposure window. DreamHost advises those users to treat the credentials as compromised.
- Webmail credentials or session data for a limited number of users. The wording differs between documents. The October 29 announcement says the attacker obtained "login credentials." The notification letter, as BleepingComputer reports it, describes "session information, including credentials." Stolen session data could let an attacker read email without knowing the password.
- Mailbox contents, which DreamHost believes may have been viewed in a small number of cases. The company says it is contacting those customers individually.
Claim Depot, a legal claims site, lists "email contents and files stored on FTP/SFTP servers" among the exposed data types. DreamHost has not confirmed that any website files were taken. Its guidance to customers does tell them to check their website files for unauthorized changes.
DreamHost says it has found no evidence that control panel logins or billing and payment details were accessed. An outside provider handles billing. webhosting.today reports that the company says the breach was unrelated to its recent PHP security updates.
According to the California filing as described by Dapeer Law and Claim Depot, affected people are being offered 12 months of Equifax Credit Watch Gold. webhosting.today reports that DreamHost says it is notifying regulators. Dapeer Law has opened an investigation into a possible class action.
DreamHost has not answered repeated questions from BleepingComputer and SecurityWeek about the number of affected accounts or the root cause.
Why It Matters
FTP/SFTP credentials for a hosting account give direct write access to a website. With them, an attacker can plant web shells, inject malicious JavaScript for card skimming or malware delivery, add SEO spam or set up phishing pages on trusted domains. DreamHost hosts around 750,000 WordPress installations, which makes it an attractive target for that kind of mass website compromise. Two months without detection means some stolen credentials may already have been used before the October 23 resets.
The webmail side is just as serious. DreamHost told account owners to look for forwarding rules they don't recognize. That is a classic sign of business email compromise: a quiet forward copies every incoming message, including password reset links, to the attacker, and it keeps working after the password is changed. Stolen session data can also bypass the password entirely.
The incident also shows the risk of third-party components in hosting control surfaces. A single browser-based file tool, built on software DreamHost has not named, became a collection point for credentials from every customer who used it.
The Attack Technique
DreamHost says the attacker exploited a vulnerability in the third-party software behind its File Manager. It has not named the software, the vulnerability or a CVE. Because the stolen credentials belonged specifically to people who logged in during the window, the likeliest explanation is that the attacker captured credentials as they were submitted to the compromised server, or pulled them from memory or logs, rather than taking a stored database. DreamHost has not confirmed how the capture worked.
The attacker then moved from the File Manager server to "certain webmail systems." DreamHost has not explained how that pivot happened. No threat actor has been named, and no group has claimed the attack publicly.
What Organizations Should Do
- Rotate every DreamHost FTP/SFTP and email password on affected accounts, even ones DreamHost did not force-reset. Change the same passwords anywhere else they were reused.
- Audit website files for tampering since August 2026. Compare against known-good backups or version control, and look for new PHP files, changed
.htaccessrules, injected scripts in theme or plugin files, and unfamiliar WordPress admin users. - Check every mailbox for forwarding rules and filters. Remove any forwarding destination or auto-delete filter you don't recognize, and review sent items for messages you didn't send.
- Treat email-linked accounts as possibly exposed. If a compromised mailbox receives password resets for other services, rotate those credentials and turn on multi-factor authentication where it is available.
- Prefer SSH key authentication over passwords for SFTP, and stop entering hosting credentials into web-based file managers where you can.
- Watch outbound and domain reputation. Monitor for blocklisting, sudden traffic spikes or spam reports that could point to a compromised site or mailbox being used for abuse.
Sources: DreamHost confirms data breach exposed FTP logins and webmail sessions | DreamHost forces password resets in ongoing "incident" | Unexplained DreamHost Incident Prompts Email, FTP Password Resets -... | October Security Incident - DreamHost | DreamHost Confirms File Manager Breach - webhosting.today | DreamHost Data Breach Letter (2026): What to Do | DreamHost Data Breach Exposes Passwords and Email Contents | DreamHost says breach exposed FTP credentials and may have reached...