DreamHost Confirms Months-Long Breach, FTP and Webmail Credentials Stolen
DreamHost confirmed that hackers exploited an undisclosed vulnerability in its web-based file manager in an attack that began in August 2026 and was discovered on October 23. Attackers stole FTP/SFTP credentials, webmail logins, and session tokens, and may have read customer emails; the company says it patched the flaw, blocked the attackers, and reset affected credentials, with no evidence of billing data compromise. Customers should change FTP and email passwords and review their accounts.
What happened
DreamHost, a web host with some 400,000 paying customers, confirmed that hackers exploited a flaw in its web-based file manager in a months-long attack, from August to October 23, 2026. The attackers stole FTP and webmail credentials and session tokens, and stole customer emails.
Why it matters
The company says affected customers are "well under 10%" of its base, without giving an exact figure. Private emails may have been read, creating fraud risk and risk of access to any service using those credentials. The incident also caused an outage spanning several days.
What to do
Change FTP/SFTP and email passwords now, sign out active sessions, and review mailboxes for suspicious access. DreamHost says it patched the flaw, blocked the attackers, and reset affected credentials; there is no evidence of billing data or control panel credential compromise.
For the technical team
- Affected
- DreamHost, provedora de hospedagem web; logins de FTP e sessões de webmail de clientes expostos · DreamHost customer accounts: FTP/SFTP logins, webmail credentials, and session tokens. The company says there is no evidence that control panel credentials or billing information were compromised. Per DreamHost, the flaw is unrelated to the vulnerabilities recently discovered in PHP web software.
- Exploitation
- Exploitation confirmed by DreamHost itself in a data breach notice filed with California's attorney general and reported by TechCrunch on November 4, 2026. Attack ran from August to October 23, 2026.
- Fix
- DreamHost says it patched the vulnerability, blocked the attackers, and reset affected credentials; it reset some customer passwords during the multi-day outage. The flaw itself is undisclosed.
- Vector
- Undisclosed vulnerability in DreamHost's web-based file manager, which customers use to store their files. The flaw allowed attackers to obtain session tokens, which keep users logged in after password entry; with a stolen token, a hacker breaks into the system as that user, without the password.
- More details
- The attack was discovered on October 23, 2026, and the breach was disclosed the Thursday before TechCrunch's report. DreamHost declined to say why the attack went undetected for months, citing an ongoing investigation, and did not name the flaw. Affected customers: "well under 10%" of roughly 400,000 paying customers. Stolen session tokens grant access as the legitimate user.
Timeline
New details: the intrusion began in August 2026, was discovered on October 23 and leveraged a flaw in DreamHost's web-based File Manager.
The host says hackers exploited a vulnerability to access customer emails and files during a months-long attack.
Incident opened.
Sources 3 sources
- @BleepinComputer @BleepinComputer
- Hackers stole DreamHost customer files and inboxes during months-long attack TechCrunch Security
- @DarkWebInformer @DarkWebInformer
