Skip to content
audiotale.net
Sign in
NewsNews

DreamHost File Manager breach: FTP and webmail credentials exposed until Oct 23

DreamHost says an attacker exploited its web File Manager server from about August to 23 October 2026. Who is affected and what to reset and check.

audiotale.net team

· 5 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. What it means
  6. What we don't know yet
  7. What to watch next
  8. Sources

DreamHost has confirmed that attackers who broke into the server behind its browser-based File Manager, files.dreamhost.com, could read the FTP/SFTP usernames and passwords of people who logged in there between about August 2026 and 23 October 2026, the day the company discovered the intrusion. The web host and domain registrar says the intruder may also have reached its webmail systems, exposing session information, including credentials, for what it calls a limited number of users. If you host a site or mailbox with DreamHost, the practical question is whether you used File Manager in that window and what to check now.

Key points

  • DreamHost says an unauthorised party exploited a vulnerability in the software running the File Manager server and could access FTP/SFTP credentials of people who logged in there from about August 2026 until 23 October 2026.
  • The intruder may also have accessed webmail systems, exposing session information including credentials for a limited number of users.
  • DreamHost says it found no evidence that control panel logins or billing and payment details were accessed.
  • A spokesperson told TechCrunch the share of affected customers is "well under 10%"; DreamHost has about 400,000 paying customers, per TechCrunch. It did not give an exact figure.
  • DreamHost invalidated passwords and ended active sessions for potentially affected users and is offering one year of credit monitoring through Equifax.

What to do

Who is affected. Per DreamHost's notification as quoted by BleepingComputer: people who logged into the File Manager at files.dreamhost.com between about August 2026 and 23 October 2026, and a limited number of webmail users. DreamHost sent notification letters to recipients; if you got one, open your control panel yourself rather than following a link in an email.

Steps (from DreamHost's guidance as reported, plus standard hygiene):

  1. Reset your FTP/SFTP and email passwords from the DreamHost panel. DreamHost already invalidated passwords for potentially affected users, so you may need to set new ones.
  2. Check your website files for unexpected changes, such as new or modified files, injected scripts or unfamiliar users. Anyone holding your FTP credentials could have written to your site.
  3. Review webmail forwarding rules and filters in every mailbox for entries you did not create.
  4. Change the password anywhere else you reused the same credentials.
  5. Be cautious with email about the incident. DreamHost says its incident emails never ask for passwords or tell you to sign in through a link.
  6. If you accept the Equifax monitoring offer, consider a fraud alert or a credit freeze, as DreamHost suggests in its letters.

How to check whether you are affected. Look for a DreamHost notice, then ask yourself whether you used the web File Manager (as opposed to a desktop FTP client) during those months. Whether use of an ordinary FTP client was exposed is not stated in the coverage we read.

What happened

According to BleepingComputer, DreamHost's notification says: "We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com." The attacker, it says, exploited a vulnerability in that software. BleepingComputer reports the company says the attack appears deliberate, that access has been blocked and that the vulnerability has been addressed.

TechCrunch adds that DreamHost disclosed the breach on a Thursday (last week, from its 4 November report) after an outage lasting several days during which some customer passwords were reset. In a data breach notice filed with California's attorney general, DreamHost said the attack began in August and let the intruders obtain session tokens, which keep users logged in after they enter a password and, if stolen, allow a break-in as that user. A search of the California AG's breach list shows an entry for DreamHost with a breach date of 15 August 2026 and a report date of 2 November 2026; we could not open the sample letter itself, so treat those dates as unconfirmed by us.

Background

A web file manager takes a username and password and then speaks FTP or SFTP on the user's behalf, so a compromised server can plausibly see whatever customers type in (our reading; DreamHost has not described the mechanism). That fits what the notification says: exposure was limited to people who logged in through that server, rather than every customer account.

Session theft is the second risk. Stolen session tokens can be replayed until they expire or are revoked, which is why DreamHost says it ended active sessions as well as invalidating passwords.

What it means

For site owners. Rotating the password is the easy part. The harder part is proving nobody used the credentials in the meantime. Because the exposure window ran for about two months, files could have been altered long before DreamHost's discovery. Compare your site against a known-good copy or version control, and review access logs if you keep them.

For people who reuse passwords. FTP credentials that match an email password or a control panel password are the real danger. DreamHost says control panel logins were not accessed, but any shared password should be changed anyway.

For hosting providers. Customers cannot see the third-party tooling in the stack. DreamHost has not named the software or described the flaw, and TechCrunch reports it was unrelated to the recently disclosed PHP vulnerabilities.

What we don't know yet

  • The vulnerability. The software and any CVE identifier have not been disclosed.
  • How many customers were affected. "Well under 10%" is all DreamHost has said; it has not answered BleepingComputer's questions about the number.
  • Why detection took about two months. A spokesperson declined to explain, citing the ongoing investigation, per TechCrunch.
  • Whether other data was taken. TechCrunch's headline says customer files and inboxes were stolen; DreamHost's own wording, as quoted, is about credentials and session information. We report what the notice says and note the difference.
  • Exact start date. "Approximately August 2026" is the company's wording.

What to watch next

  • A fuller incident report from DreamHost naming the flaw and the number affected.
  • Reports of defaced or backdoored sites on DreamHost-hosted domains.
  • Phishing that imitates the breach notice.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next