DreamHost Confirms Breach Exposed FTP Credentials and Webmail Sessions

Summary

DreamHost says attackers exploited a File Manager vulnerability from August to Oct. 23, 2026, accessing FTP/SFTP credentials and possibly some webmail sessions. It blocked access, fixed the flaw, invalidated passwords and ended active sessions.

Key points

• DreamHost said an unauthorized third party accessed its web-based File Manager from approximately August 2026 until the breach was discovered on Oct. 23.
• The attacker exploited a vulnerability and accessed FTP/SFTP usernames and passwords of people who logged in to the File Manager during that period.
• DreamHost said the intruder may also have accessed webmail systems, exposing session information, including credentials, for a limited number of users.
• The company said it found no evidence that control-panel login information or customer billing and payment details were accessed.
• DreamHost said it blocked the attackers, addressed the vulnerability, invalidated passwords and stopped active sessions for potentially affected users.
• The company advised notification recipients to check website files and webmail settings, and to change reused passwords; it offered impacted individuals one year of credit monitoring and identity-theft protection.

Vendors

Industries

Related Articles

• DreamHost Reports Intrusion Exposing FTP, SFTP and Webmail Credentialssecurityonline.infoDreamHost
• DreamHost Resets Some Email and FTP Passwords After Unexplained Systems Issuesecurityweek.comDreamHost
• DreamHost Forces Email and FTP/SFTP Password Resets After Incidentbleepingcomputer.comDreamHost
• PHP2Shell Patch Risks and Modern Incident Response Discussed on Security WeeklySecurity Weekly - A CRA ResourceDreamHost