DreamHost is warning customers about a data breach in which attackers accessed its web-based file manager for approximately two months and stole FTP/SFTP usernames and passwords. The US web hosting provider and domain registrar said the incident lasted from August 2026 until October 23, 2026, when it was discovered, and that some webmail accounts and session information may also have been exposed.
Attack exposed FTP and SFTP credentials
According to DreamHost’s data breach notification, an unauthorized third party accessed the server hosting its web-based file manager at files.dreamhost.com.
“An unauthorized third party was able to exploit a vulnerability in that software and gain access to the FTP/SFTP usernames and passwords of individuals who logged into this file manager between approximately August 2026 and October 23, 2026,” the company said.
DreamHost also reported that the attackers accessed its webmail system. The incident may have exposed session information, including credentials belonging to a limited number of users.
The company said the attack appeared to be intentional and that it had blocked the attackers’ access and fixed the exploited vulnerability. DreamHost also terminated active sessions and disabled passwords for potentially affected users.
No evidence of control-panel billing access
DreamHost said it has not found evidence that the attackers accessed login information or customer billing and payment details for control panels operated by external providers.
BleepingComputer contacted DreamHost multiple times to ask about the incident and the number of affected accounts, but the company did not respond.
What affected customers should do
Recipients of DreamHost’s notification should check their websites for unauthorized file changes and review webmail forwarding rules and filters for suspicious modifications. They should also change passwords on other accounts where the same credentials were reused.
DreamHost said it will provide affected individuals with one year of credit monitoring and identity theft protection through Equifax. Recipients are also being asked to consider placing a fraud alert or security freeze on their credit reports.
Source: www.bleepingcomputer.com