DreamHost breach exposed FTP/SFTP and webmail credentials

DreamHost confirms an unauthorized party broke into the server running its web-based File Manager and stole the FTP/SFTP usernames and passwords of customers who used the tool, along with the login credentials of a limited number of webmail users. The access ran from roughly August 2026 until October 23, 2026, the day DreamHost detected it. If you logged into DreamHost's File Manager in that window, treat your FTP/SFTP and mail credentials as compromised.

The primary account is DreamHost's own October security incident notice; it was first reported by BleepingComputer and SecurityWeek.

What happened

Per DreamHost's notice, "an unauthorized third party accessed the server that runs our web-based File Manager" at files.dreamhost.com by exploiting "a vulnerability in that software." The intruder was able to read the FTP/SFTP credentials of users who authenticated to the File Manager, and separately reached certain webmail systems, obtaining the login credentials of a limited number of webmail users.

DreamHost has not named the vulnerable software, assigned a CVE, or said whether the flaw was a known or zero-day issue. It describes the activity as deliberate.

What's confirmed and what isn't

• Confirmed exposed: FTP/SFTP usernames and passwords for File Manager users; webmail login credentials for a limited set of users.
• Said to be unaffected: DreamHost reports "no evidence" that control-panel logins or billing/payment details were accessed.
• Not disclosed: the number of affected accounts. DreamHost did not answer repeated questions on scope.

What DreamHost did

DreamHost says it blocked the attacker, patched the exploited vulnerability, ended active File Manager sessions, and invalidated affected passwords. Affected customers are being offered a year of credit monitoring and identity-theft protection through Equifax.

Action checklist

1. Rotate FTP/SFTP passwords and keys now if you used the File Manager since August — a forced reset is not the same as a credential you chose and trust.
2. Change your webmail password and audit webmail forwarding rules and filters for anything you did not create; silent auto-forwarding is the classic post-breach persistence trick.
3. Review your hosted site files for unauthorized changes, injected scripts, or new admin accounts — stolen FTP credentials are used to plant webshells and skimmers.
4. Change the same password anywhere you reused it, especially the DreamHost panel, and enable multi-factor authentication on the control panel.
5. Rotate any secrets (API tokens, DB credentials, .env values) that lived in files reachable over FTP/SFTP.

Context

A stolen FTP/SFTP password at a shared host is rarely the end of the story: it is the opening move for mass site defacement, SEO-spam injection and Magecart-style payment skimmers planted straight into customers' document roots. The webmail angle is the quieter risk — a hijacked mailbox plus a forwarding rule survives a password reset and feeds business-email-compromise. DreamHost's refusal to state the affected-account count, or name the File Manager flaw, leaves customers unable to judge their own exposure; the safe assumption for anyone who touched the tool this autumn is that both their file-transfer and mail credentials are in someone else's hands.