DreamHost Says Breach Exposed FTP Logins and Webmail Sessions

DreamHost says an attacker accessed its web-based File Manager through a software vulnerability, exposing FTP/SFTP usernames and passwords belonging to people who used the tool between approximately August 2026 and October 23, 2026. The company discovered the breach on October 23, 2026.

The web hosting provider and domain registrar said the intruder may also have accessed webmail systems, exposing session information, including credentials, for a limited number of users. DreamHost described the attack as appearing deliberate and said staff worked to contain it.

DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing and payment details, which are handled by an external provider. The company said it blocked the attacker’s access, fixed the vulnerability, ended active sessions for potentially affected users, and invalidated passwords.

BleepingComputer reported that its questions to DreamHost about the incident and the number of affected accounts had gone unanswered. DreamHost is offering affected people one year of credit monitoring and identity theft protection through Equifax. Its notification also advises recipients to check website files and webmail rules, and to change reused passwords.