DreamHost says attackers exploited its web-based File Manager to access FTP/SFTP usernames and passwords belonging to customers who logged in between approximately August 2026 and October 23. The exposure raises questions about website integrity as well as account access.
According to the company’s breach notification filed with California’s attorney general, the intruder reached the server behind files.dreamhost.com and certain webmail systems. Session information, including credentials, may have been exposed for a limited number of webmail users. Email contents and files stored on FTP/SFTP servers may also have been accessed.
DreamHost reports no evidence of access to control panel credentials or billing details. It says it addressed the vulnerability, ended potentially affected users’ active sessions and reset passwords. The notification does not identify a CVE or give an affected-account total.
BleepingComputer reported the disclosure on November 4 and said its questions to DreamHost about the number of affected accounts had gone unanswered. That leaves customers without a public figure for the incident’s overall scale.
For customers: inspect what access could have changed
DreamHost’s recommended checks include website files, mailbox forwarding rules and filters, and other accounts sharing the same or similar credentials. Customers should report suspicious changes to the company.
The practical distinction is between closing an attacker’s access and finding changes already made. A password reset helps with the first task; it does not establish whether a website’s files or a mailbox’s settings remain trustworthy. For a site owner, a useful review starts with unexpected files and changes that do not match a known deployment or administrator action.
Mailbox review deserves the same attention. Forwarding and filtering settings control where messages go and which messages a user sees. Record unfamiliar settings before changing them so support has something concrete to investigate. If the affected account belongs to a business, coordinate that review with whoever maintains its website and email rather than treating the reset notice as the end of the response.
