Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

DreamHost confirms File Manager breach exposed FTP and email credentials

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

DreamHost says a File Manager flaw exposed FTP/SFTP and some webmail credentials for under 10% of accounts; passwords were reset.

DreamHost confirmed unauthorized access to its web-based File Manager, discovered on October 23, 2026, after attackers used the tool as far back as August 2026. They obtained FTP/SFTP usernames and passwords and some webmail credentials affecting well under 10% of hosted email and FTP accounts. Cyber Security News reports attackers accessed private mailbox contents in a small number of cases; GBHackers says an attacker may have viewed some mailboxes. According to GBHackers, the company attributes the breach to a third-party software vulnerability. DreamHost reset passwords, ended sessions, found no control panel or billing access, restored File Manager on October 26, and is rebuilding the service and notifying regulators.

Key facts
  • Unauthorized access discovered October 23, 2026, with exposure dating to August 2026.
  • Well under 10% of hosted email and FTP/SFTP accounts were affected.
  • Stolen data included FTP/SFTP credentials and some webmail logins.
  • No control panel logins or customer billing details were accessed.
  • Passwords were reset, sessions ended, and File Manager returned October 26.
  • GBHackers says a third-party software flaw was used; regulators are being notified.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026Unauthorized File Manager access discovered. · Cyber Security News
  2. Oct 26, 2026File Manager returned online. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsFile Manager back online October 26; service rebuilt with safeguards.
  • GBHackersThird-party software flaw; sites and email stayed up; regulators notified.
Vendors
DreamHost
Products
File Manager
Victims
DreamHost customers

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Cyber Security NewsFirst report

    DreamHost confirms breach of File Manager exposing FTP credentials

    Attackers exploited a flaw in DreamHost File Manager to steal FTP/SFTP usernames/passwords and some webmail credentials from fewer than 10% of accounts; passwords have been reset.

  2. · 6d ago GBHackers

    DreamHost Confirms Data Breach of FTP/SFTP and Webmail Credentials

    DreamHost File Manager breach exposed FTP/SFTP credentials and some webmail logins; attackers may have viewed mailboxes, affecting under 10% of accounts.