DreamHost File Manager Breach Ran for Two Months: FTP/SFTP Logins Captured From August to 23 October and Some Webmail Sessions Exposed

High · 2026-11-05 · By H.A

DreamHost says an attacker exploited a flaw in its web-based File Manager from August until discovery on 23 October 2026, capturing FTP/SFTP credentials of users who logged in and possibly webmail session data, with fewer than 10% of customers affected.

Overview

Web host DreamHost has confirmed that an attacker went undetected inside its web-based File Manager (files.dreamhost[.]com) for about two months. In a breach notice filed with the California Attorney General, the company says the intrusion began in August 2026 and was discovered on 23 October 2026. During that time the attacker could capture the FTP/SFTP usernames and passwords of every customer who logged in to File Manager. The attacker may also have reached webmail systems and exposed session information, including credentials, for a limited number of users.

DreamHost says fewer than 10% of customers were affected ("well under 10%") but has not given an exact number. The company says it has about 400,000 paying customers.

The Incident

DreamHost's notice says an unauthorised party exploited a vulnerability in the software running File Manager. The company has not named or described the flaw. It says the issue is unrelated to the recently disclosed PHP vulnerabilities that have been exploited widely this autumn. DreamHost describes the attack as deliberate.

DreamHost says the attacker did not obtain:

• Control panel login information
• Billing or payment card data, which an external provider handles

The exposed data includes:

• FTP/SFTP credentials for File Manager users during the intrusion window
• Webmail session tokens and credentials for a smaller group of users

Customer files and mailboxes are also at risk. With valid FTP credentials an attacker can read or change website content, and with a stolen webmail session token an attacker can open a mailbox without a password or MFA prompt.

Timeline

• August 2026: The intrusion into the File Manager server begins.
• 23 October 2026: DreamHost discovers the breach, blocks access and fixes the vulnerability.
• Late October 2026: A multi-day disruption follows. DreamHost forces resets of email and FTP/SFTP passwords and ends active sessions.
• Early November 2026: A formal breach notice is filed with the California Attorney General, and affected customers are offered one year of credit monitoring and identity-theft protection.

DreamHost has declined to explain why the intrusion went undetected for about two months, citing an ongoing investigation.

Tradecraft

This is a common pattern for hosting providers. Attacking the shared web front end that customers use to reach their hosting accounts yields credentials for many tenants at once. Collecting credentials at login, instead of stealing a stored password database, works even when passwords are strongly hashed at rest. Stealing session tokens bypasses password resets and MFA until those sessions are revoked.

The likely follow-on risks for affected customers are:

• Web shells, SEO spam, skimmers or malicious redirects planted in website files over FTP
• Mail forwarding rules or filters added to webmail accounts to steal mail quietly
• Credential stuffing against other services where the same FTP or email password was reused
• Phishing that uses details from stolen mailboxes

Indicators of Compromise

DreamHost has not published technical indicators. Customers should look for:

• Recently modified PHP, JavaScript or .htaccess files they did not change
• New or unexpected files in web roots, especially obfuscated PHP
• Webmail forwarding addresses or filters they did not create
• FTP/SFTP logins from unfamiliar IP addresses since August 2026

Detection

# Defensive: list files modified since 1 August 2026 in a site directory
find ~/example.com -type f -newermt "2026-08-01" -printf '%TY-%Tm-%Td %TH:%TM  %p\n' | sort

# Look for common web-shell traits in PHP files
grep -rlE "eval\(base64_decode|gzinflate\(|assert\(\\\$_(POST|GET)" ~/example.com --include=*.php

Compare the results with your own deployment history or a known-good backup taken before August.

Recommended Actions

• Confirm that you set new FTP/SFTP and email passwords after DreamHost's forced reset, and change those passwords anywhere else they were used.
• Switch to SFTP or SSH keys where possible, and remove old FTP users you no longer need.
• Check webmail forwarding rules, filters and auto-replies.
• Restore any changed site files from a clean backup and rotate application secrets stored on the server (database passwords, API keys in config files).
• Enable MFA on the DreamHost control panel and on any account that used the same email address.
• People in the US who received a notice can place a fraud alert or credit freeze and use the credit monitoring offered.

Analyst Assessment

The hosting front end is a high-value target, and a two-month detection gap gave the attacker plenty of time to build up access. Billing data appears safe, but FTP credentials and webmail sessions are what attackers need to compromise websites and run mailbox fraud, and the effects can outlast password resets if site files were changed. DreamHost customers who used File Manager between August and late October should treat their sites as possibly altered until they have checked them. We rate the incident High.