"We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," DreamHost wrote in its notification, describing a breach that ran from August 2026 until October 23, 2026.
DreamHost's account of the intrusion
DreamHost has confirmed attackers gained access to its File Manager platform and stole FTP/SFTP credentials for users who logged into that web-based tool during the window from approximately August 2026 through October 23, 2026 — the day the company says it discovered the activity. In its data breach notification the company said an "unauthorized third party exploited a vulnerability in that software" to obtain the usernames and passwords.
The notification also says the intruder may have accessed webmail systems, exposing session information and credentials for a limited number of users. DreamHost described the attack as deliberate and said its staff has been working nonstop to contain it.
Data types exposed: FTP/SFTP logins and webmail sessions
According to the notification, the primary data confirmed as exposed were FTP and SFTP usernames and passwords for individuals who used the File Manager at files.dreamhost.com during the affected period. Separately, DreamHost cautioned that session information — including credentials — for a limited number of webmail users may also have been exposed.
The company reported it has "found no evidence" that the attacker accessed control panel login information or customer billing and payment details; billing and payment data are handled by an external provider, DreamHost added.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleContainment and remediation steps DreamHost reports
DreamHost says it has blocked the attackers' access and addressed the vulnerability the intruder exploited. The firm stopped active sessions for potentially affected users and invalidated passwords; it also previously required users to reset their email and FTP/SFTP passwords as part of its response. DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax and urged recipients to consider placing a fraud alert or security freeze on their credit reports.
BleepingComputer contacted DreamHost multiple times seeking details, including the exact number of impacted accounts, but said its inquiries went unanswered.
Guidance DreamHost sent to notified recipients
- Check website files for unauthorized changes.
- Review webmail forwarding rules and filters for unexpected entries.
- Change passwords on any other accounts where the same credentials may have been reused.
- Take up the offered one-year Equifax credit monitoring and identity-theft protection.
- Consider placing a fraud alert or security freeze with credit bureaus.
How technologists, affected customers, and regulators are likely to respond
Technologists and security teams will focus on the exploited software vulnerability that allowed access to files.dreamhost.com, and on session-handling weaknesses that could expose webmail credentials; DreamHost has said it "addressed the vulnerability" and blocked access, but the notification itself names the File Manager server and the exploitation window as the key facts.
Affected customers — particularly those who logged into the web-based File Manager between August 2026 and October 23, 2026 — were told to inspect site content and email forwarding rules, change reused passwords, and accept the offered credit monitoring. The company’s statement that billing and payment data are handled by an external provider, and that there is no evidence those data were accessed, will be a focal point for customers reviewing their financial exposure.
Regulators and consumer-protection observers will note two points named in DreamHost's notice: the explicit timeframe of the exposure and the absence, per DreamHost, of any evidence that control panel or billing/payment information was taken. The unanswered questions about the number of impacted accounts — noted by BleepingComputer’s repeated contact attempts — are likely to inform follow-up scrutiny and any required notifications or investigations.
DreamHost's notification lays out what was taken, when the activity occurred, and the immediate steps the company took to stop it; what it does not quantify is how many accounts were affected. The firm’s offer of identity monitoring and its instructions to customers are clear. The remaining, practical question for users and overseers alike is simple and factual: how many credentials were exposed during those two months, and will any follow‑on misuse appear in the weeks ahead?
Original reporting: BleepingComputer — DreamHost confirms data breach exposed FTP logins and webmail sessions
