DreamHost has disclosed a data breach affecting its File Manager platform, where unauthorized attackers obtained FTP/SFTP credentials for customers during a two-month window. The American web hosting and domain registration company previously notified users of a security incident requiring password resets, and now details the full scope of the compromise.
According to DreamHost's breach notification, the intrusion lasted from August 2026 through October 23, 2026, when the company discovered the unauthorized access. The attackers exploited a vulnerability in the software running the web-based File Manager at files.dreamhost.com to steal credentials.
We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com. The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026.
DreamHost
Beyond file transfer protocol credentials, DreamHost indicated that webmail systems may have been compromised as well. Session information and login credentials for a subset of users could have been accessed through this vector.
The company characterized the attack as intentional and stated that staff members worked continuously to contain the incident. DreamHost found no evidence that attackers accessed control panel login credentials or customer billing and payment information, which is managed by an external provider.
To remediate the breach, DreamHost has terminated the attackers' access, patched the exploited vulnerability, terminated active sessions for potentially impacted users, and invalidated passwords. Despite multiple inquiries from BleepingComputer regarding the incident details and the number of affected accounts, the company has not provided additional information.
Customers who received breach notifications should examine their website files for unauthorized modifications, audit webmail forwarding rules and message filters, and update passwords on any other services where the same credentials may have been reused.
DreamHost is offering impacted customers one year of complimentary credit monitoring and identity theft protection services through Equifax. The company also recommends that affected individuals consider placing a fraud alert or requesting a security freeze on their credit reports.