DreamHost Confirms Data Breach of FTP/SFTP and Webmail Credentials
Original title: DreamHost Confirms Data Breach After Hackers Steal FTP/SFTP Credentials and Access Customer Emails
DreamHost File Manager breach exposed FTP/SFTP credentials and some webmail logins; attackers may have viewed mailboxes, affecting under 10% of accounts.
DreamHost confirmed unauthorized access to its File Manager on October 23, 2026, which exposed FTP/SFTP usernames/passwords and limited webmail credentials. The company attributes it to a vulnerability in third-party software. Passwords were reset, sessions terminated. No evidence of control panel or payment card access. Websites and email remained available. Company is notifying regulators.
- Discovered on October 23, 2026
- Affected well under 10% of hosted email and FTP/SFTP accounts
- Used File Manager between August 2026 and October 23
- Attacker may have viewed some mailbox contents
- No access to control panel logins or customer billing details
Impact: exposure of FTP/SFTP credentials and limited webmail login credentials
| Product | Affected |
|---|---|
| DreamHost File Manager | — |
| DreamHost webmail | — |
- 1.Reset affected passwords
- 2.Terminate active sessions
- 3.Update saved credentials
- Vendors
- DreamHost
- Victims
- DreamHost customers
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | files.dreamhost.com | n unauthorized third party compromised the server operating files.dreamhost.com, a web interface customers use to manage website files. The |
From the original article
2 min read at gbhackers.com
DreamHost has confirmed a security breach involving its browser-based File Manager, which exposed FTP/SFTP usernames and passwords, as well as the credentials of a limited number of webmail users. The company discovered unauthorized access on October 23, 2026, and it believes that attackers may have viewed the contents of some mailboxes. Affected customers are being […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.