DreamHost Confirms Data Breach Exposing Customer Credentials
Web hosting provider DreamHost has confirmed a data breach resulting from the exploitation of its web-based File Manager, leading to the exposure of customer FTP/SFTP and webmail credentials.
Web hosting provider DreamHost has confirmed a significant data breach that exposed customer login details after attackers exploited a vulnerability within its web-based File Manager. The company disclosed that malicious actors successfully obtained FTP/SFTP usernames and passwords, along with credentials for some webmail accounts. In a limited number of instances, attackers may have also gained access to view the contents of private mailboxes.
DreamHost's security team first detected unauthorized access on October 23, 2026. Their subsequent investigation revealed that the potential exposure window could extend as far back as August. Customers who utilized the File Manager during this period have been advised to consider their file transfer credentials compromised, even as the investigation continues to ascertain the full extent of the breach.
Currently, DreamHost estimates that well under 10% of its hosted email and FTP/SFTP accounts were affected. This figure represents affected accounts rather than a definitive number of individual customers. The company had previously initiated precautionary password resets for some users, which temporarily prevented affected individuals from logging in until new passwords were created, though not all resets necessarily indicated compromised credentials.
The vulnerability was traced to a flaw in third-party software that powers the File Manager, a tool designed to help customers manage their website files. DreamHost has not publicly disclosed the specific software or provided a CVE identifier for the vulnerability. The attackers also accessed certain webmail systems, compromising credentials for a limited number of users.
DreamHost took immediate action by resetting affected webmail passwords and terminating active sessions on October 23. The company is directly contacting customers whose mailbox contents may have been viewed. While widespread email theft has not been confirmed, DreamHost is taking comprehensive steps to secure its systems.
Following the discovery, DreamHost took the affected File Manager server offline for forensic analysis. The service has since been rebuilt with enhanced security measures and monitoring. The company also reset potentially compromised internal credentials and engaged external cybersecurity experts to assist with the investigation and remediation.
DreamHost has assured customers that there is no evidence to suggest that attackers accessed control panel logins or customer billing details. Furthermore, since an external processor handles payment card transactions, full credit card numbers are not stored on DreamHost's systems.
DreamHost is advising all affected users to reset their account passwords via the control panel, use unique and strong passwords, and update any reused credentials on other platforms. Customers are also encouraged to review their website files for any unauthorized modifications and to check their email forwarding rules and filters for suspicious entries. The company reiterates its security advice to always type the DreamHost control panel URL directly into the browser and to be wary of unsolicited login requests.