DreamHost Breach Exposes FTP and Webmail Credentials

Web hosting provider DreamHost has confirmed that login credentials for customers' hosting and webmail accounts fell into the hands of attackers. The company announced the incident in a data breach notification sent to affected customers and asked users to take steps to strengthen their account security.

According to the company, the incident was noticed roughly two weeks ago. DreamHost found that an unauthorized third party had accessed the server that runs File Manager, its web-based file management tool at files.DreamHost.com. The access reportedly took place in August 2026, and the company describes the event as a deliberate attack.

What the attackers got

The notification says the attackers exploited a security vulnerability in the File Manager software. DreamHost did not provide details about the nature of the flaw. Through it, the attackers gained access to the FTP/SFTP usernames and passwords of logged-in users. They also reached some webmail systems and obtained session information, including login credentials, for a limited number of webmail users.

With credentials exposed, anything stored in File Manager and webmail should be treated as at risk. Compromised email accounts can be used to send spam, run phishing campaigns and carry out Business Email Compromise (BEC) attacks, which can be very hard to detect. Users who notice unusual activity in their accounts should act quickly.

Are payment details safe?

DreamHost stresses that its investigation is ongoing and the picture may change. Still, the company says it currently has no evidence that the attackers accessed control panel login credentials or customers' billing details. It states that it does not store full payment card numbers, only a secure token representing the card, and that this token cannot be used to make purchases elsewhere.

DreamHost said it will update its notice if significant new information emerges. The identity of the attackers was not disclosed, and the company did not say whether they have made a ransom demand. It said only that it regards the incident as a deliberate attack and that its team is working around the clock to contain it. At the time the notification was published, no group had claimed responsibility, and no sign of the data surfacing on the dark web had been reported.

DreamHost's response and advice for users

The company says it has taken steps to cut off the attackers' access to its systems and to close the exploited vulnerability. Active sessions for potentially affected users were terminated and their passwords were reset. A user who finds their password has been reset when trying to log in should therefore assume their data may have been affected. DreamHost says it has put additional security measures in place but did not say what they are. It also said it is working with outside legal counsel and security and forensics specialists to handle the incident properly.

Customers are being asked to review their account statements, report any suspicious activity to the police, obtain and monitor their credit reports, and place fraud alerts on them. DreamHost is also offering everyone affected one year of free credit monitoring and identity theft protection through Equifax, a fairly standard measure in incidents of this kind.

DreamHost has faced similar incidents before. In 2012, attackers broke into a database server and put customers' FTP and shell access passwords at risk; the company reset the affected passwords and reported no significant malicious activity against customer accounts. In 2017, its DNS infrastructure was hit by a major DDoS attack that caused widespread connectivity problems for customers.