DreamHost says a File Manager breach exposed FTP passwords and webmail sessions
DreamHost said an unauthorized third party accessed the server running its web-based File Manager from approximately August 2026 through October 23, 2026, when the company discovered the incident. The American hosting provider and domain registrar said the attacker accessed FTP/SFTP usernames and passwords belonging to people who logged into the File Manager during that period.
According to DreamHost’s breach notification, the attacker exploited a vulnerability in the File Manager software. That access exposed stored FTP and SFTP credentials, which can be used to connect to websites and transfer files. DreamHost also said the intruder may have accessed webmail systems and session information, including credentials, for a limited number of users.
DreamHost said it blocked the attacker’s access and addressed the vulnerability. The company also said it stopped active sessions for potentially affected users and invalidated passwords. It found no evidence that the attacker accessed control-panel login information or customer billing and payment details, which DreamHost said are handled by an external provider.
DreamHost advised people who received breach notifications to check their website files for unauthorized changes and review webmail forwarding rules and filters. The company also told them to change passwords on other accounts where they reused the exposed credentials.
DreamHost said affected individuals can receive one year of credit monitoring and identity theft protection through Equifax. The company also urged notification recipients to consider placing a fraud alert or requesting a security freeze on their credit report.
DreamHost has not disclosed the number of affected accounts. BleepingComputer said the company did not answer its questions about the scope of the incident.