DreamHost Confirms Data Breach of FTP/SFTP and Webmail Credentials
DreamHost File Manager breach exposed FTP/SFTP credentials and some webmail logins; attackers may have viewed mailboxes, affecting under 10% of accounts.
60
Vendor
DreamHost
- Mentions · 7d2
- Mentions · 30d8
- All mentions8
- First seenOct 26, 2026
- Last mentioned6d ago
Timeline
8 articles · newest firstDreamHost confirms breach of File Manager exposing FTP credentials
Attackers exploited a flaw in DreamHost File Manager to steal FTP/SFTP usernames/passwords and some webmail credentials from fewer than 10% of accounts; passwords have been reset.
55
DreamHost confirms customer data theft in months-long attack
Hackers stole emails, credentials and session tokens from DreamHost customers via file manager vulnerability; attack started in August.
70
DreamHost data breach exposed FTP logins and webmail sessions
DreamHost confirmed attackers accessed File Manager from August to October 2026, stealing FTP/SFTP credentials and webmail sessions.
60
DreamHost resets some email and FTP passwords after systems issue
File Manager was taken offline and later restored; DreamHost has not stated a cause or how many users were affected.
46
DreamHost resets some email and FTP passwords after service incident
File Manager is back, but DreamHost still has not named a cause or how many accounts needed resets.
48
DreamHost forces password resets after File Manager and webmail incident
The hoster expired affected email and FTP/SFTP passwords but has not confirmed unauthorized access or data theft.
48
DreamHost forces email and FTP password resets in ongoing incident
File Manager access is still down, and users cannot log in until account owners set new credentials.
58
Appears with
- File Managerproduct · 5
- email hostingproduct · 1
- DreamHostvictim · 1
- DreamHost webmailproduct · 1
- FTP/SFTPproduct · 1
- DreamHost customersvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.