DreamHost Data Breach Exposes FTP Credentials and Webmail Sessions

DreamHost, the American web hosting provider and domain registrar, has confirmed a data breach that exposed FTP/SFTP usernames and passwords for a subset of its customers.

The company disclosed that an unauthorised third party exploited a vulnerability in its web-based File Manager platform, located at files.dreamhost.com. The breach was active for approximately two months, spanning from August 2026 until it was discovered on 23 October 2026.

Scope of the Compromise

In addition to the exposure of FTP/SFTP credentials, DreamHost stated that the intruder may have also accessed webmail systems. This potentially exposed session information, including credentials, for a limited number of users.

The company indicated that the attack appeared to be a deliberate effort. However, DreamHost reported finding no evidence that attackers gained access to customer control panel login information or billing and payment details, as these are managed by an external provider.

Response and Mitigation

Following the discovery of the incident, DreamHost reported that it has blocked the attackers’ access and addressed the underlying software vulnerability. The firm also invalidated passwords and terminated active sessions for users potentially impacted by the breach.

To mitigate the risk of identity theft, DreamHost is offering affected individuals one year of credit monitoring and identity theft protection through Equifax. Impacted users are also encouraged to consider placing a fraud alert or a security freeze on their credit reports.

Affected customers are advised to take the following immediate steps to secure their accounts:

• Review website files for any unauthorised changes or suspicious code.
• Check webmail settings, specifically looking for unauthorised forwarding rules or filters.
• Change passwords on any other services that utilised the same credentials as the exposed FTP or webmail accounts.