DreamHost Confirms Data Breach After Hackers Steal FTP/SFTP Credentials and Access Customer Emails

DreamHost has confirmed a security breach involving its browser-based File Manager, which exposed FTP/SFTP usernames and passwords, as well as the credentials of a limited number of webmail users.

The company discovered unauthorized access on October 23, 2026, and it believes that attackers may have viewed the contents of some mailboxes. Affected customers are being contacted individually.

The disclosure expands on earlier reports of forced password resets affecting email and FTP/SFTP accounts, which initially described precautionary recovery measures without confirming credential theft. DreamHost now attributes the intrusion to exploitation of a vulnerability in third-party software powering its File Manager.

DreamHost Data Breach

According to DreamHost’s incident notice, an unauthorized third party compromised the server operating files.dreamhost.com, a web interface customers use to manage website files. The exploit allowed access to FTP/SFTP credentials for users who logged into the tool before detection.

Customers who used File Manager between approximately August 2026 and October 23 should treat those usernames and passwords as compromised. The attacker also reached certain webmail systems and obtained login credentials. DreamHost reset affected passwords and terminated active sessions on the day it discovered the intrusion.

The company estimates the incident affected well under 10% of hosted email and FTP/SFTP accounts. It cautioned that precautionary notifications reached more customers than investigators currently believe were affected, so receiving a reset notice does not confirm exposure.

DreamHost has found no evidence that attackers accessed control panel logins or customer billing details. It also said it does not store full payment card numbers because a third party processes payments.

DreamHost immediately removed the affected File Manager servers from service, addressed the exploited vulnerability, and preserved the compromised server for forensic analysis. It subsequently rebuilt and relaunched File Manager with additional security precautions and enhanced monitoring.

The provider rotated potentially exposed internal credentials, engaged outside security and forensic specialists, and began reviewing other customer-facing tools for similar weaknesses. Its service status portal provides operational updates covering File Manager, webmail, hosting, and related services.

DreamHost said websites and email remained available throughout the incident, with mailboxes continuing to receive messages even when users could not authenticate. The company is notifying applicable regulators and preparing formal customer notices required under relevant national laws.

Only the DreamHost account holder can assign replacement passwords through the account control panel. Changes may take up to 15 minutes to become effective. Customers should update saved credentials in email and file-transfer applications and replace reused or similar passwords elsewhere.

Administrators should inspect website files for unfamiliar modifications and review mailbox forwarding rules and filters. Customers should also follow phishing-prevention practices, especially when handling unsolicited messages requesting credentials.

DreamHost warned that its incident emails never request passwords or direct recipients to sign in through links. Users should navigate directly to the control panel. The company also stated that the breach was unrelated to recent PHP server updates, while its forensic investigation remains ongoing.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.