DreamHost breach exposed FTP logins and webmail sessions

DreamHost has confirmed that an unauthorized third party accessed its web-based File Manager and stole FTP/SFTP usernames and passwords, according to a data breach notification. The company said an "unauthorized third party exploited a vulnerability in that software" and was able to reach credentials of people who logged into File Manager between approximately August 2026 and October 23, 2026, when the breach was discovered. The disclosure follows DreamHost's earlier announcement that it required users to reset email and FTP/SFTP passwords during an ongoing incident.

The web host added that the attacker may have gotten into webmail and could have exposed session details, such as credentials, for some users. The company found no evidence that control panel login information or billing and payment details were accessed; billing and payment details are handled by an external provider. The company said it cut off the intruder's access, patched the flaw, terminated active sessions for users who might have been affected, and reset their passwords. The company described the attack as deliberate.

The exact number of affected accounts has not been disclosed. BleepingComputer reported that DreamHost did not answer its questions about the number of impacted accounts. A review by Strauss Borrelli PLLC of the California Attorney General's data security breach portal likewise found no disclosed number of affected people. The portal listing dates the incident to August 15, 2026 and shows November 2, 2026 as the reported date, according to Strauss Borrelli. The law firm said the available regulatory record did not identify the attack method or confirm that every DreamHost customer was affected.

Strauss Borrelli said the California Attorney General's listing suggests usernames and passwords could have been compromised, but the sample notice text was not available. The company told recipients of the notice to look for unauthorized changes in site files, examine webmail forwarding rules and filters, and update passwords on any other accounts that use the same credentials. DreamHost is providing affected customers with credit monitoring and identity theft protection from Equifax for one year. The notice also advises recipients to think about adding a fraud alert or freezing their credit file.