DreamHost Breach Exposes FTP and Webmail Credentials

DreamHost confirmed a cyber intrusion involving a vulnerability in its web-based file manager. The company’s preliminary forensic investigation found that suspicious activity began around August 2026 and continued until 23 October, when staff detected unusual behaviour and disabled the file manager. The attackers reportedly accessed several server clusters, harvesting FTP and SFTP credentials from customers who used the interface and intercepting active session tokens. Those tokens could allow an attacker to impersonate website administrators.

The intrusion also reached several corporate webmail environments. DreamHost confirmed that login credentials for a limited group of webmail users were obtained and said it had contacted affected account holders. The compromised credentials could expose customers’ email, while FTP and SFTP access could give attackers the ability to copy website files or alter hosted content.

The source also says attackers could access database configuration files and inject malicious JavaScript, but does not report that these actions occurred.

DreamHost urged subscribers to change account, database and SFTP passwords, check server directories for unfamiliar files or changes, review webmail forwarding and filtering rules, and audit database users and permissions.