DreamHost has confirmed that attackers breached its web-based File Manager platform and stole customers’ FTP/SFTP usernames and passwords over a two-month period. The web hosting provider and domain registrar disclosed the incident after earlier warning users to reset their email and FTP/SFTP passwords.

According to a data breach notification, the intrusion lasted from approximately August 2026 until October 23, 2026, when it was discovered. DreamHost said an unauthorized third party accessed the server running its File Manager at files.dreamhost.com by exploiting a vulnerability in the software.

“The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026,” the notification states.

DreamHost also said the attacker may have accessed webmail systems, exposing session information, including credentials, for a limited number of users. The company described the attack as deliberate and said staff worked continuously to contain it.

No Evidence of Billing Data Theft

DreamHost said it found no evidence that the attacker accessed control panel login credentials or customer billing and payment details, which are managed by an external provider. The company says it has since blocked the attackers’ access, patched the exploited vulnerability, terminated active sessions for potentially affected accounts, and invalidated passwords.

BleepingComputer reported that DreamHost did not respond to multiple requests for comment on the incident or the total number of affected accounts.

Recommended Actions

DreamHost is advising affected customers to:

  • Check website files for unauthorized changes
  • Review webmail forwarding rules and filters for suspicious modifications
  • Change passwords on any other accounts where the same credentials were reused

The company is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax, and is urging recipients of breach notification letters to consider placing a fraud alert or security freeze on their credit reports.