DreamHost data breach: File Manager flaw exposed FTP passwords

Web host DreamHost says an unauthorised third party exploited a vulnerability in the third-party software behind its browser-based File Manager and took the FTP and SFTP usernames and passwords of customers who logged into it from about August until October 23. In the notice it filed with California's attorney general, the company says the contents of customers' email and of files on their FTP/SFTP accounts may also have been accessed, and the filing gives the breach date as August 15, 2026.

When DreamHost took File Manager offline on October 23 and reset email and FTP passwords, it gave customers no cause, and SecurityWeek reported that it had not said whether passwords were accessed. Its October 29 post now calls the intrusion "a deliberate attack" and says it affected a fraction of the email and FTP/SFTP accounts it hosts, "well under approximately 10%." A spokesperson repeated that figure to TechCrunch but would not give an exact number; DreamHost says it has some 400,000 paying customers.

What DreamHost says was taken

Besides the File Manager logins, the threat actor reached certain webmail systems and obtained the login credentials of a limited number of webmail users, according to DreamHost. "In a small number of cases, we believe the unauthorized third party may have used those credentials to view mailbox contents," the post says, adding that those customers are being contacted individually. The regulator notice describes the webmail exposure as session information, "the data that keeps a user signed in".

DreamHost says it found no evidence that control panel logins or billing details were accessed, and that it does not store full card numbers. It has not named the File Manager software or the vulnerability, and a spokesperson declined to say why the attack went undetected until October 23. The company says the incident was not related to its recent PHP security updates: its PHP servers were patched within hours, and its web application firewall blocked tens of thousands of intrusion attempts in the days before those patches were released.

Who should act

DreamHost tells anyone who logged into File Manager, or whose FTP/SFTP users did, between about August and October 23 to treat those usernames and passwords as compromised and to change the same or similar passwords elsewhere. A mailbox that was signed out on or after October 23 had its password reset by DreamHost. A password that still works and was not changed by the customer was not exposed, its investigation indicates so far. Only the account holder can set new passwords, from the control panel.

The company also asks customers to look over their website files for changes they did not make and to check webmail forwarding rules and filters for anything they did not set up. The regulator notice adds one year of Equifax identity theft protection and suggests a fraud alert on credit reports for anyone whose email or files held details that could open another account.

DreamHost says it has rebuilt File Manager with extra monitoring, rotated internal credentials that may have been exposed and is reviewing its other customer-facing tools for similar vulnerabilities, with outside forensics experts.