DreamHost reports breach exposing hosting credentials and some webmail sessions

DreamHost says attackers exploited a vulnerability in the software behind its web-based File Manager to access customer hosting credentials and some webmail session information.

The company said it discovered unauthorized access to the server running files.DreamHost.com roughly two weeks before its notification. The access occurred during August 2026. DreamHost did not disclose details of the vulnerability or identify the attackers.

According to DreamHost, the attackers obtained FTP/SFTP usernames and passwords belonging to people logged in to the File Manager. They also accessed session information, including credentials, for a “limited number” of webmail users. The company said its investigation is ongoing and that the available information is inconclusive. It reported no current evidence that attackers accessed control panel login information or customer billing details.

DreamHost said it terminated potentially affected active sessions, reset passwords, and took steps to address the vulnerability and prevent further access. It did not specify its additional security measures. The company said it is working with outside legal advisers and security and forensics experts.

DreamHost said it has found no evidence that the data has leaked to the dark web and that no attackers have claimed responsibility. The company’s earlier incidents included a database-server intrusion in 2012 and a DDoS attack on its DNS infrastructure in 2017.