DreamHost Data Breach FTP Passwords Explained: Months-Long Attack, Stolen Sessions and What Customers Must Do
Illustrative image: rows of servers in a server room. No photo of the DreamHost breach itself exists, and this is not a DreamHost facility. Image: Wikimedia Commons / Florian Hirzinger.
TL;DR — DreamHost data breach FTP passwords explained in one line: attackers spent about two months inside web host DreamHost's file-manager server, stealing FTP/SFTP logins and possibly webmail sessions, before the company spotted the intrusion on 23 October 2026 and forced password resets.
📌 KEY HIGHLIGHTS
- The window: unauthorised access ran from August 2026 until DreamHost discovered it on 23 October 2026.
- The way in: an unspecified vulnerability in DreamHost's web-based File Manager at files.dreamhost.com.
- What was taken: FTP/SFTP usernames and passwords of customers who logged into the File Manager in that window, plus possibly email contents, stored files and webmail session data.
- What was not taken (so far): no evidence that control-panel logins or billing and payment details were accessed.
- The scale: DreamHost says affected customers are "well under 10%" of its roughly 400,000 paying customers, but has not given an exact number.
- The response: attacker access blocked, the vulnerability fixed, sessions terminated, passwords invalidated, and one year of Equifax identity-theft protection offered to those notified.
What happened?
DreamHost, a US web host and domain registrar with around 400,000 paying customers, disclosed a cybersecurity incident last week after it caused a multi-day outage and forced password resets for some customers. The fuller picture arrived in a data-breach notice filed with California's attorney general on 2 November 2026, and reported by TechCrunch and BleepingComputer on 4 November.
According to that notice, an unauthorised third party accessed the server running DreamHost's web-based File Manager at files.dreamhost.com, exploiting a vulnerability in that software. DreamHost has not said which flaw, only that it is unrelated to recently discovered PHP vulnerabilities, and it describes the attack as apparently deliberate.
The uncomfortable part is the duration. The access ran from August 2026 until 23 October, when DreamHost discovered it — roughly two months during which the intruder could collect credentials as customers logged in. DreamHost has declined to say why the attack went undetected until then, citing an ongoing investigation.
DreamHost data breach FTP passwords explained: what was actually stolen
The notice is specific about one group and vaguer about the rest. Anyone who logged into the web-based File Manager between approximately August 2026 and 23 October 2026 may have had their FTP/SFTP username and password accessed — the keys to a website's files, which is why DreamHost tells notified customers to check their site files for unauthorised changes.
Beyond that, the intruder may also have reached certain webmail systems, potentially exposing session information — including session credentials — for a limited number of users. A stolen session can open a mailbox without the password until it is killed. DreamHost says email contents and files stored on FTP/SFTP servers may also have been accessed.
| Data | Status in DreamHost's notice |
|---|---|
| FTP/SFTP usernames and passwords | Accessed, for customers who used the File Manager Aug – 23 Oct 2026 |
| Email contents and files on FTP/SFTP servers | May also have been accessed |
| Webmail session information / credentials | May have been exposed, for a limited number of users |
| Control-panel logins | No evidence of access |
| Billing / payment details | No evidence of access; full card numbers are not stored by DreamHost |
Illustrative image: servers in a data centre. The DreamHost intrusion targeted one file-manager server, not a whole data centre. Image: Wikimedia Commons / BalticServers, CC BY-SA 3.0.
Why it matters for website owners
This breach is a reminder that a hosting account is only as safe as its weakest login. FTP credentials are often old, shared and reused elsewhere — exactly the kind that keeps working quietly after a breach. And with weeks inside, the attacker could do more than steal a password: a compromised mailbox can reset other accounts, and a tampered site can serve malware to visitors.
It also fits the week's supply-chain pattern: the Amadeus breach affecting airlines exposed many carriers' customers through one vendor, and the WordPress core flaw exploited in the wild showed attackers racing a routine update. DreamHost is the same shape at a smaller scale.
Should you care? ✅ / ⏳
✅ Yes, if you host a site or use email with DreamHost — especially if you used its File Manager between August and 23 October 2026. Change those credentials, check site files and mail forwarding rules, and never reuse the old password. ⏳ But don't panic about billing — no evidence payment details or control-panel logins were touched.
What DreamHost customers should do now
DreamHost has terminated sessions and invalidated exposed passwords, but notified customers should still: change FTP/SFTP and webmail passwords (and any reused copies); inspect site files for changes they did not make; review webmail forwarding rules and filters, which attackers use to silently copy mail; and watch for phishing quoting real account details. If you got a breach letter, take up the offered year of Equifax protection.
FAQs
What happened in the DreamHost data breach? From August 2026 to 23 October 2026, an unauthorised party accessed DreamHost's File Manager server via a software vulnerability. DreamHost found it on 23 October, after a multi-day outage, and filed its breach notice with California's attorney general on 2 November.
Was my DreamHost password stolen? Possibly, if you logged into the File Manager between August 2026 and 23 October 2026 — the notice says those users' FTP/SFTP logins were accessible to the intruder. DreamHost invalidated them, but change them (and reused copies) anyway.
Did DreamHost leak payment information? No evidence of that so far. DreamHost says its investigation found no sign that control-panel login information or customer billing and payment details were accessed, and that it does not store full payment card numbers.
How many DreamHost customers are affected? DreamHost has not said. Its spokesperson told TechCrunch the number is "well under 10%" of roughly 400,000 paying customers, but declined to be precise, and BleepingComputer's questions about the exact count went unanswered.
Takeaway: A two-month intrusion into one file-manager server put FTP logins, emails and site files at risk for a slice of DreamHost's customers. The fix is unglamorous but effective: new unique passwords, a check of your site files and mail rules, and suspicion toward any message that knows too much about your account.
Follow USA Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- TechCrunch — Hackers stole DreamHost customer files and inboxes during months-long attack (4 November 2026)
- BleepingComputer — DreamHost confirms data breach exposed FTP logins and webmail sessions (4 November 2026)
- Dapeer Law — DreamHost Data Breach Letter (2026): California Attorney General filing summary, filed 2 November 2026
Comments
Post a Comment