DreamHost File Manager breach steals FTP credentials and webmail session data
TL;DR
DreamHost confirmed a breach of its web-based File Manager that exposed FTP/SFTP credentials and webmail session data. Attackers maintained access for two months between August and October 23, 2026. Users must reset their email and FTP/SFTP passwords immediately.
What happened
Attackers exploited a vulnerability in the software running the web-based File Manager at files.dreamhost.com. This unauthorized access lasted from approximately August 2026 until the breach was discovered on October 23, 2026.
During this window, the intruder captured FTP and SFTP usernames and passwords from individuals logging into the File Manager. The attacker may have also accessed webmail systems to steal session information and credentials for a limited number of users. DreamHost stated the attack appeared deliberate. The company has since blocked the attacker's access and addressed the exploited vulnerability.
Why it matters
This is a significant credential exposure because it targets the core of web hosting management. By capturing FTP/SFTP credentials, attackers can potentially modify website files, inject malicious code, or deface sites. The exposure of webmail sessions adds another layer of risk, potentially allowing unauthorized access to email communications. While DreamHost reports no evidence of compromised control panel logins or billing details, the stolen credentials could be used for credential stuffing attacks on other platforms if users reused those passwords.
Who is affected
- DreamHost customers who used the web-based File Manager at
files.dreamhost.combetween August 2026 and October 23, 2026. - A limited number of users whose webmail session information or credentials were accessed.
What to do now
- Reset all FTP/SFTP and email passwords immediately.
- Check your website files for any unauthorized changes or suspicious code.
- Review your webmail forwarding rules and filters to ensure no unauthorized redirects were created.
- Change passwords on any other external accounts that use the same credentials.
- Monitor your credit reports or consider placing a security freeze or fraud alert.
What we don't know yet
- The specific CVE or technical details of the vulnerability used to exploit the File Manager.
- The exact number of accounts and users impacted by the breach.
- The identity of the unauthorized third party responsible for the attack.
Sources
