DreamHost says an attacker accessed the server behind its web-based File Manager and stole FTP/SFTP usernames and passwords belonging to people who used the service during the breach period. The company says the incident lasted from August 2026 until October 23, when it was discovered.
According to DreamHost’s breach notification, the intruder exploited a vulnerability in the software running at files.dreamhost.com. The company also says webmail systems may have been accessed, potentially exposing session information, including credentials, for a limited number of users.
DreamHost said it found no evidence that the attacker accessed control panel login details or customer billing and payment information, which is handled by an external provider. The company says it has blocked the attacker’s access, fixed the vulnerability, ended active sessions for potentially affected users, and invalidated passwords.
People who received a notification are advised to check their website files for unauthorized changes, review webmail forwarding rules and filters, and update passwords on other accounts if they reused the exposed credentials. DreamHost is offering affected individuals one year of credit monitoring and identity theft protection through Equifax. The notification also advises recipients to consider placing a fraud alert or security freeze on their credit report.
DreamHost has not provided a figure for the number of affected accounts.
Sources: BleepingComputer.