DreamHost File Manager Breach: FTP, Webmail Credentials and Inboxes Exposed in Months-Long Intrusion
MAG212 CYBER | Cyber Incidents | November 6, 2026
Web host DreamHost has disclosed that an attacker broke into the server behind its browser-based File Manager and harvested FTP/SFTP credentials of customers who used it, plus webmail credentials and session information for a smaller group. In some cases the attacker viewed mailbox contents. DreamHost found the intrusion on 23 October 2026, but its filing with the California Attorney General gives a breach date of 15 August 2026, roughly ten weeks earlier. The software flaw that let the attacker in has not been named.
Faits clés
| Article | Détail |
|---|---|
| Company | DreamHost, LLC |
| System | Web-based File Manager at files.dreamhost.com, “built on third-party software” |
| Breach date | 15 August 2026 (California AG breach list) |
| Discovered | Afternoon of Friday, 23 October 2026 |
| Exposed | FTP/SFTP usernames and passwords; webmail credentials and session information for a limited number of users |
| Possibly involved | Email contents and files on the FTP/SFTP server (per notice letter) |
| Not affected | No evidence of control panel or billing access, per DreamHost |
| Portée | “Well under approximately 10%” of accounts hosted at DreamHost |
| Offer | One year of Equifax Credit Watch Gold |
| Vulnérabilité | Not named; no CVE published |
Timeline
| Date (2026) | Événement |
|---|---|
| 15 August | Breach date listed for DreamHost, LLC on the California AG’s breach list |
| About August to 23 October | Period in which File Manager users’ FTP/SFTP credentials were exposed |
| 23 October | DreamHost discovers the intrusion, takes File Manager offline, resets webmail passwords and ends sessions |
| 23 to 25 October | Account owners emailed from Friday evening through the weekend |
| 29 October | DreamHost publishes its “October security incident” announcement |
| 2 November | Breach reported to the California Attorney General |
| 4 November | TechCrunch reports that hackers stole customer files and inboxes during a months-long attack |
The roughly ten-week gap between the breach date and discovery is our calculation from those two dates. DreamHost declined to tell TechCrunch why the intrusion went undetected so long, citing “an ongoing investigation”.
What DreamHost confirmed
In its 29 October announcement, DreamHost said an unauthorized third party accessed the server running its File Manager. It described the event as a deliberate attack that exploited a vulnerability in the third-party software File Manager is built on. It did not name the software.
DreamHost said the attacker obtained:
- FTP/SFTP usernames and passwords of users who logged into File Manager from about August 2026 through 23 October 2026.
- Webmail login credentials for a limited number of users. In a small number of cases, the attacker may have used them to view mailbox contents. DreamHost is contacting those customers individually.
DreamHost said it found no evidence that control panel logins or billing details were accessed, and that it does not store full card numbers. It said fewer customers were affected than it first suspected, and that not everyone who got the initial warning email was affected. Sites and email stayed up throughout.
DreamHost also said the incident was not related to recent PHP server updates. It patched its PHP servers within hours and said its web application firewall blocked “tens of thousands” of intrusion attempts before those patches.
What the notice letter and TechCrunch add
The sample notice letter DreamHost filed with the California AG on 2 November goes further than the public announcement on the data involved. It lists usernames and passwords used for File Manager or webmail, session information or credentials, and possibly email contents and files on the FTP/SFTP server. It says webmail access “may have exposed the session information” of a limited number of users. The letter’s count of affected people is left as a placeholder, and it does not name the File Manager software.
TechCrunch reported on 4 November, citing the California notice, that the attack began in August and that the attackers obtained session tokens through an unspecified vulnerability in the file manager. The disclosure followed a several-day outage during which some passwords were reset.
How many customers?
DreamHost says “well under approximately 10%” of accounts hosted with it were affected. A spokesperson told TechCrunch “well under 10%” but would not give a number. DreamHost advertises some 400,000 paying customers, according to TechCrunch. That would put the affected group below roughly 40,000, but this is our arithmetic, not a disclosed figure, and “accounts hosted” may not equal “customers”.
What DreamHost has done
- Reset webmail passwords and ended active sessions on 23 October.
- Took the File Manager server out of service and preserved it for forensic analysis.
- Rebuilt File Manager with added controls and monitoring.
- Rotated internal credentials and began reviewing other customer-facing tools.
- Hired outside forensic experts and began notifying regulators.
- Offered affected people one year of Equifax Credit Watch Gold, which includes up to $1 million of identity-theft insurance underwritten by American Bankers Insurance Company of Florida.
Updates are posted at dreamhoststatus.com.
Checklist for DreamHost customers
DreamHost’s advice: if you, or any FTP/SFTP user on your account, logged into File Manager between about August 2026 and 23 October, treat those credentials as compromised. A practical checklist:
- Rotate FTP/SFTP passwords for every user on the account, through the panel only. DreamHost notes a new password can take up to 15 minutes to work. Update saved passwords in your FTP clients and deployment tools.
- Rotate email passwords and update every mail client and phone that uses them.
- Check webmail forwarding rules and filters. Attackers with mailbox access often add a forward or a rule that hides replies. Remove anything you didn’t create.
- Review site files changed since mid-August. Look for new or modified PHP files, unfamiliar uploads and edited
.htaccessfiles. On a shell account, a quick check:
find ~/ -type f -newermt "2026-08-15" -printf "%TY-%Tm-%Td %p\n" | sort- Rotate secrets stored in hosted files. If an attacker could read your files, assume they could read database passwords, API keys, SMTP credentials and salts in files such as
wp-config.phpou.env. Change them at the source, then update the files. - Check WordPress administrators. Remove admin accounts you don’t recognize and reset passwords for real ones.
- Watch for phishing. DreamHost says it never asks for passwords by email and that its incident emails never ask you to sign in through a link. Change passwords only at panel.dreamhost.com, and expect breach-themed phishing.
- Use unique passwords. If you reused an FTP or mail password anywhere else, change it there too.
Lessons for hosting customers
Convenience tools are part of your attack surface. A browser-based file manager handles credentials for the files that make up your website. When it is built on third-party software, a flaw in that software can expose every user who logs in, through no fault of their own.
Credential theft lasts beyond the fix. DreamHost has patched and rebuilt File Manager, but stolen FTP passwords keep working until they are changed. The same goes for any secrets read from your files.
Dwell time matters. Ten weeks is long enough for an attacker to plant backdoors that survive a password reset. That is why reviewing file changes matters as much as rotating credentials.
Keep secrets out of reach where you can. Prefer SFTP with keys over passwords where your host supports it, keep secrets outside the web root, and keep an independent backup so you can compare and restore.
Foire aux questions
Was my DreamHost account affected?
DreamHost says only users who logged into File Manager from about August 2026 to 23 October 2026 had FTP/SFTP credentials exposed, and that it emailed affected account owners. If you used File Manager in that window, treat those credentials as compromised.
Were payment details stolen?
DreamHost says it found no evidence that control panel logins or billing details were accessed, and it does not store full card numbers.
What software was exploited?
DreamHost says File Manager is built on third-party software and that an attacker exploited a vulnerability in it. Neither DreamHost, the California notice nor TechCrunch has named the software or a CVE.
Is DreamHost offering credit monitoring?
Yes. The notice letter offers one year of Equifax Credit Watch Gold, including up to $1 million of identity-theft insurance.
Sources
- DreamHost: October security incident (29 Oct 2026)
- California AG: data breach list
- California AG: DreamHost, LLC entry
- California AG: DreamHost sample notice letter (PDF)
- TechCrunch: Hackers stole DreamHost customer files and inboxes during months-long attack (4 Nov 2026)
This article expands a story from the MAG212 CYBER Daily, 6 November 2026.