DreamHost Confirms Data Breach After Hackers Steal FTP/SFTP Credentials and Access Customer Emails - GBHackers News
DreamHost has confirmed a security breach affecting its browser-based File Manager, exposing FTP/SFTP usernames and passwords and compromising a limited number of webmail accounts.
The company attributes the intrusion to a vulnerability in third-party software powering its File Manager. Customers who used the service between approximately August 2026 and October 23 should treat those credentials as compromised. DreamHost has reset affected passwords and terminated active sessions upon discovery.
Limited Impact Assessment
DreamHost estimates the incident affected well under 10% of hosted email and FTP/SFTP accounts. The company has found no evidence that attackers accessed control panel logins or customer billing details, noting it doesn't store full payment card numbers as a third party processes payments.
Security Response
DreamHost immediately removed affected File Manager servers from service, addressed the exploited vulnerability, and preserved the compromised server for forensic analysis. The provider has rebuilt and relaunched File Manager with additional security precautions and enhanced monitoring.
The company is notifying applicable regulators and preparing formal customer notices required under relevant national laws.
Customer Actions
Only the DreamHost account holder can assign replacement passwords through the account control panel, with changes potentially taking up to 15 minutes to become effective. Customers should update saved credentials in email and file-transfer applications and replace reused or similar passwords elsewhere.
Administrators should inspect website files for unfamiliar modifications and review mailbox forwarding rules and filters. DreamHost warned that its incident emails never request passwords or direct recipients to sign in through links, urging users to navigate directly to the control panel.
Related
