DreamHost has notified customers that an intruder accessed the server behind its browser-based File Manager at files.dreamhost.com and took FTP/SFTP login credentials, the Los Angeles-based web hosting provider and domain registrar said. The company said the unauthorized access began around August 2026 and lasted until October 23, 2026, when the intrusion was discovered. The exposed data covers FTP/SFTP usernames and passwords for people who signed in to that File Manager during that window.
According to the company's breach notification, the attacker used a flaw in the File Manager software to reach those credentials. DreamHost also said the intruder may have gotten into webmail systems and exposed session information, including credentials, for a limited number of users. The company described the attack as deliberate and said its staff worked continuously to contain it.
DreamHost said it has found no sign that the attacker reached control panel login information or customer billing and payment details, which are handled by an outside provider. The company said it has cut off the attacker's access, fixed the vulnerability that was exploited, ended active sessions for users who may have been affected and invalidated passwords. The notification follows DreamHost's earlier announcement that it had dealt with a cybersecurity incident that required users to reset their email and FTP/SFTP passwords.
DreamHost has not disclosed how many accounts were affected. BleepingComputer said it contacted the company repeatedly to ask about the incident and the number of impacted accounts but received no response.
Customers who received the notification are being told to look through their website files for unauthorized changes and to review webmail forwarding rules and filters. They are also advised to change passwords on any other accounts that use the same credentials. DreamHost is offering affected individuals a year of credit monitoring and identity theft protection through Equifax, and the notification urges recipients to consider a fraud alert or a security freeze on their credit reports.
The incident puts pressure on DreamHost customers across the United States who rely on the company for hosting and domain registration, since reused FTP/SFTP and webmail credentials could expose other services. The notification gives those users a specific list of steps to check their sites and mail settings for signs of tampering.
More cybersecurity news from TechManNews.
