DreamHost confirms data breach exposed FTP logins and webmail sessions

DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.

This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords.

In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.

"We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," reads the notification.

"The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."

In addition, DreamHost says the intruder may have also accessed webmail systems, exposing session information, including credentials, for a limited number of users.

The firm said the attack appears deliberate, and its staff has been working nonstop to contain it fully.

At this time, DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing/payment details, which an external provider handles.

The company says it has blocked the attackers' access and addressed the vulnerability exploited in the attack.

The company also stopped active sessions for potentially affected users and invalidated passwords.

BleepingComputer has contacted DreamHost multiple times with questions about the incident and the exact number of impacted accounts, but our inquiries have gone unanswered.

Recipients of the notifications are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where they may be using the same credentials.

To mitigate the risks from this exposure, DreamHost offers impacted individuals one year of credit monitoring and identity theft protection through Equifax.

Letter recipients are also urged to consider placing a fraud alert or asking for a security freeze on their credit report.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.