DreamHost is notifying customers after attackers spent roughly two months inside its web-based File Manager and walked away with FTP and SFTP usernames and passwords. In a small number of cases, the company now says the intruder may also have opened customer mailboxes. Formal breach notices went out in early November, and DreamHost has published a detailed account of what it found.
What happened
On the afternoon of Friday, October 23, 2026, DreamHost discovered that an unauthorized party had reached the server that runs its browser-based File Manager at files.dreamhost.com. That tool is built on third-party software and lets customers edit website files without a separate FTP client.
According to DreamHost's October 29 announcement and later state breach letters, the attacker exploited a vulnerability in that software. Anyone who logged into File Manager between about August 2026 and October 23 had their FTP or SFTP username and password exposed. The company took File Manager offline the same day, patched the flaw, reset passwords for email and file-transfer users it believed could be affected, and ended active sessions.
The investigation also found that the attacker reached certain webmail systems and obtained login credentials for a limited set of webmail users. In a small number of those cases, DreamHost believes the attacker used those credentials to view mailbox contents, and it says it is contacting those customers individually.
DreamHost describes the intrusion as deliberate. It says it has found no evidence so far that control panel logins or billing details were reached. Card payments are handled by an outside processor, and DreamHost says it does not store full payment card numbers.
Who is affected
DreamHost's current analysis puts the impact at a fraction of hosted email and FTP/SFTP accounts, well under about 10%. Customers may be in scope if they, or an FTP/SFTP user on their account, logged into File Manager during the August-to-October window, or if an email password stopped working on or after October 23 because DreamHost reset it. The company notes that receiving an early password-reset email does not by itself prove a given mailbox was compromised, and that the known affected set has shrunk as the investigation continued.
If an email or FTP password still works and the customer did not change it, DreamHost says its investigation so far indicates that password was not exposed, though it still recommends changing it as a precaution.
What DreamHost says it has done
- Blocked the attacker, fixed the exploited vulnerability, and preserved the compromised File Manager server for forensics.
- Rebuilt File Manager with extra security checks and monitoring before bringing it back online.
- Rotated internal credentials that may have been exposed and reviewed other customer-facing tools for similar flaws.
- Hired outside security and forensics firms and begun notifying regulators as required.
- Offered affected individuals one year of Equifax credit monitoring and identity-theft protection in formal notices.
DreamHost also stresses that websites and email stayed online during the response. Inboxes kept receiving mail even when passwords were reset, and files remained in place on FTP/SFTP accounts.
What you should do
- If you used DreamHost File Manager between August and October 23, 2026, treat those FTP/SFTP credentials as compromised and set new ones from the account control panel. Only the account holder can reset them there.
- Change any reused passwords on other sites or services.
- Update email, FTP, and SFTP clients that still hold the old passwords.
- Scan website files for unexpected changes, and check webmail forwarding rules and filters for anything you did not create.
- Watch for phishing: DreamHost says it will never email asking for your password, and incident messages will not ask you to sign in through a link. Type
https://panel.dreamhost.com/yourself if you need the control panel. - If you host client or customer data on DreamHost, talk to your own counsel about any notice duties you may have.
0 Comments