DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident.
The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed.
According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts.
The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure.
A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion.
DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company.
Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access.
Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere.
To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity.
BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.
Read the original article:
DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information