DreamHost Says Attackers Stole FTP Passwords and May Have Reached Webmail Sessions for Two Months

By Kaeleb Savon Heck

UNITED STATES, Nov. 6, 2026 — DreamHost says an attacker who exploited its web File Manager for roughly two months stole FTP and SFTP usernames and passwords from customers who logged into that tool, and may also have exposed session credentials for a limited number of webmail users.

In a data breach notification reported by BleepingComputer on Nov. 4, 2026, and summarized again by The Hacker News on Nov. 5, the U.S. web hosting provider and domain registrar said the unauthorized party accessed the server that runs its web-based File Manager at files.dreamhost.com. The window ran from approximately August 2026 through Oct. 23, 2026, the day DreamHost says it discovered the intrusion.

The company believes the attack was deliberate. It says it has blocked the attacker's access, addressed the vulnerability that was exploited, stopped active sessions for potentially affected users and invalidated passwords. It also says it has found no evidence that the attacker reached control panel login information or customer billing and payment details, which an external provider handles.

What DreamHost has not published, at least in the coverage reviewed for this report, is a headcount of affected accounts. BleepingComputer said it asked repeatedly about the exact number of impacted accounts and received no answer.

What was exposed

According to the notification language quoted by BleepingComputer, the unauthorized party "exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."

The Hacker News account adds that the attacker may have accessed credentials used for the File Manager or webmail, along with the contents of emails and files on the FTP/SFTP server. DreamHost's own wording, as quoted in that roundup, says the unauthorized party "was also able to reach certain webmail systems, which may have exposed the session information (the data that keeps a user signed in, including session credentials) of a limited number of webmail users."

Those two exposures are related but not identical. FTP and SFTP passwords are long-lived secrets that often remain valid until someone changes them. Webmail session information is shorter-lived in theory, but it can still let an attacker act as a signed-in user while the session remains valid, and stolen mailbox access is a classic way to plant forwarding rules or reset passwords elsewhere.

DreamHost had already told customers about an incident that required email and FTP/SFTP password resets before the fuller breach notification spelled out the File Manager path and the August-to-October window.

What DreamHost says was not taken

The company draws a line around systems it says show no evidence of access: control panel logins and billing or payment details. That distinction matters for customers trying to triage risk. A stolen FTP password can still wreck a website. A stolen billing profile would raise a different set of fraud and payment-card worries. DreamHost's current public position is that the latter category was not reached, while the former was.

"No evidence" is not the same as a completed forensic public report. It is the company's statement as of the notifications covered by BleepingComputer and The Hacker News. Customers still have reason to treat any reused password as burned and to inspect what an FTP login could have touched.

Containment steps already taken

DreamHost says it blocked attacker access and fixed the vulnerability in the File Manager software. It stopped active sessions for potentially affected users and invalidated passwords. Those moves are standard after credential theft: cut the live path, rotate secrets, and close the bug that let the attacker in.

Notification recipients are being offered one year of Equifax credit monitoring and identity theft protection. DreamHost also urges people who received the letter to consider placing a fraud alert or requesting a security freeze on their credit report. Those offers address identity-theft fallout more than website integrity, but they are part of the company's published mitigation package.

Practical advice for customers

BleepingComputer reported the notification advice in direct terms. Recipients should:

• Check website files for unauthorized changes.
• Review webmail forwarding rules and filters.
• Change passwords on any other accounts where the same credentials were reused.

Those three steps map to the most common post-hosting-breach failure modes. An attacker with FTP access can replace index pages, inject skimmers, drop webshells or quietly alter configuration files. A webmail session or mailbox credential can be used to create a forward that silently copies future messages, including password-reset mail from banks, registrars or software vendors. Password reuse turns one hosting incident into a chain of account takeovers on unrelated services.

Customers who share FTP credentials across staging and production, or who leave old SFTP users active for former contractors, face a wider blast radius than the File Manager login window alone suggests. Rotating every credential that overlapped with that August-to-October period, then reviewing file modification dates and mailbox rules, is the conservative response even if DreamHost never publishes a precise victim count.

Analysis: why FTP theft is still high-impact in 2026

FTP and SFTP feel like plumbing. Many site owners treat them as a way to push WordPress themes or static assets and then forget the credentials exist. Attackers do not forget. A valid file-transfer login is often enough to:

• Deface or redirect a site.
• Inject malware that hits visitors rather than the hosting account itself.
• Plant persistence that survives a single password change if a backdoor file remains.
• Harvest other secrets stored in site configuration files, such as database passwords or API keys.

That is why a breach limited to File Manager users who logged in during a defined window can still be severe for those users even when control panels and billing systems appear untouched. The trust boundary that failed was the file-management surface, and that surface sits close to the public website.

Webmail session exposure raises a second problem set. Session credentials can allow access without the long-term password if the session is still honored. Even after sessions are killed, any period of mailbox access may have been enough to change forwarding rules, download message archives or use the mailbox as a beachhead for social engineering against the customer's contacts. DreamHost's statement that only a limited number of webmail users may have been affected is narrower than the FTP claim, but "limited" without a number still leaves customers dependent on whether they received a notification.

The unanswered headcount is more than a public-relations gap. Without it, independent researchers cannot gauge how widely the File Manager vulnerability was exercised, insurers and downstream partners cannot size exposure cleanly, and customers who did not get a letter cannot be sure whether silence means safety or incomplete notification. BleepingComputer's unanswered questions underline that opacity.

Broader hosting lesson without drifting into other incidents

Shared and managed hosting concentrates risk: one vulnerable administrative tool can expose many tenants' file-transfer secrets at once. File Manager interfaces exist to make hosting easier for people who do not want a raw FTP client. That convenience expands the attack surface whenever the web tool holds or can retrieve live credentials.

The DreamHost notice also illustrates a familiar disclosure pattern. First comes an urgent password-reset message. Then comes a fuller explanation of the system that was hit, the window, and the categories of data involved. Customers who acted on the first message by rotating email and FTP passwords still need the second message's guidance on file inspection and forwarding-rule review, because password rotation alone does not undo unauthorized file edits or mailbox rules created during the intrusion window.

What's next

• Customer remediation: Anyone notified should finish password rotation, inspect site files and webmail rules, and treat reused passwords as compromised elsewhere.
• Credit monitoring: Notification recipients can enroll in the one-year Equifax offer and consider a fraud alert or security freeze.
• Public accounting: DreamHost had not, in the Nov. 4–5 coverage reviewed here, published the number of impacted accounts despite repeated questions from BleepingComputer.
• Monitoring for follow-on abuse: Site owners should watch for unexpected DNS changes, new admin users, unfamiliar cron jobs or outbound spam originating from hosted mailboxes in the weeks after containment.

Until a fuller count and technical postmortem appear, the verified picture is specific but incomplete: a deliberate File Manager intrusion lasting from about August to Oct. 23, 2026; stolen FTP/SFTP passwords for users who logged into that tool; possible webmail session exposure for some users; no reported evidence of control-panel or billing access; and a containment effort that includes blocked access, a patched vulnerability, killed sessions and invalidated passwords.

Sources

• BleepingComputer, "DreamHost confirms data breach exposed FTP logins and webmail sessions," Nov. 4, 2026: https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/
• The Hacker News, "ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories," Nov. 5, 2026: https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html