DreamHost confirms months-long breach via File Manager flaw: FTP/SFTP credentials, webmail sessions and customer data exposed

Linha do tempo

1. securityonline.info ↗ · pub. 06/11/2026 05:00 · coletado 06/11 06:00

   DreamHost Security Breach Exposes FTP and Webmail Data

   ler a análise desta fonte ocultar

   Web hosting provider DreamHost recently confirmed a severe cyber intrusion across its infrastructure. Specifically, an adversary exploited an application vulnerability within its web-based file manager. The attackers harvested administrative FTP and SFTP credentials from active customers. Furthermore, unauthorized parties gained illicit access to internal webmail databases. Consequently, the DreamHost security breach jeopardizes numerous hosted websites and private communication records.

   Preliminary forensic investigations reveal that the intrusion remained undetected for nearly three months. Specifically, hostile activities began around August 2026 and continued through October 23, 2026. Operations personnel identified anomalous system behavior on October 23 and deactivated the file manager immediately. However, deeper analysis revealed significant exposure across multiple server clusters.

2. gbhackers.com ↗ · pub. 05/11/2026 03:26 · coletado 05/11 04:00

   DreamHost Confirms Data Breach: File Manager Flaw Exposed FTP/SFTP and Webmail Credentials

   This DreamHost advisory adds that the company rotated potentially exposed internal credentials and began reviewing other customer-facing tools for similar weaknesses, is notifying applicable regulators and preparing formal customer notices under relevant national laws (beyond the California attorney general filing already known), and that websites and email remained available throughout, with mailboxes continuing to receive messages even when users could not authenticate; the forensic investigation remains ongoing.

   ler a análise desta fonte ocultar

   This DreamHost advisory adds that the company rotated potentially exposed internal credentials and began reviewing other customer-facing tools for similar weaknesses, is notifying applicable regulators and preparing formal customer notices under relevant national laws (beyond the California attorney general filing already known), and that websites and email remained available throughout, with mailboxes continuing to receive messages even when users could not authenticate; the forensic investigation remains ongoing.

   DreamHost has confirmed a security breach in which attackers exploited a vulnerability in third-party software powering its browser-based File Manager, exposing FTP/SFTP usernames and passwords as well as credentials for a limited number of webmail users. The company discovered unauthorized access on October 23, 2026, to the server running files.dreamhost.com, and believes attackers may have viewed the contents of some mailboxes. Customers who used File Manager between approximately August 2026 and October 23 should treat their FTP/SFTP credentials as compromised. DreamHost estimates the incident affected well under 10% of hosted email and FTP/SFTP accounts and found no evidence that control panel logins or billing/payment data were accessed, noting it does not store full card numbers since a third party processes payments.

   Technical Details

   DreamHost reset affected passwords and terminated active sessions the day it discovered the intrusion, removed the affected File Manager servers from service, and preserved the compromised server for forensic analysis before rebuilding and relaunching File Manager with additional security precautions and enhanced monitoring. The company said websites and email remained available throughout the incident, with mailboxes continuing to receive messages even when users could not authenticate, and stated the breach was unrelated to recent PHP server updates. Its forensic investigation remains ongoing, and it is notifying applicable regulators and preparing formal customer notices required under relevant national laws.

   Remediation

   Only the DreamHost account holder can assign replacement passwords through the account control panel, with changes taking up to 15 minutes to become effective; customers should update saved credentials in email and file-transfer applications and replace reused or similar passwords elsewhere. Administrators should inspect website files for unfamiliar modifications and review mailbox forwarding rules and filters, and follow phishing-prevention practices when handling unsolicited messages requesting credentials. DreamHost warned that its incident emails never request passwords or direct recipients to sign in through links, and said it rotated potentially exposed internal credentials, engaged outside security and forensic specialists, and began reviewing other customer-facing tools for similar weaknesses.

3. techcrunch.com ↗ · pub. 04/11/2026 17:36 · coletado 04/11 18:00

   DreamHost Confirms Hackers Stole Customer Files and Inboxes in Months-Long Breach

   The article confirms that attackers not only harvested credentials but also stole customer files stored via DreamHost's file manager and accessed inbox contents, and clarifies that the compromised session tokens allowed attackers to impersonate logged-in users without needing passwords. It also notes DreamHost declined to explain why detection took so long and reiterates the breach began in August and affects well under 10% of its roughly 400,000 paying customers.

   ler a análise desta fonte ocultar

   The article confirms that attackers not only harvested credentials but also stole customer files stored via DreamHost's file manager and accessed inbox contents, and clarifies that the compromised session tokens allowed attackers to impersonate logged-in users without needing passwords. It also notes DreamHost declined to explain why detection took so long and reiterates the breach began in August and affects well under 10% of its roughly 400,000 paying customers.

   DreamHost has confirmed that attackers stole customer files and inbox contents during a months-long intrusion into its systems, disclosed last Thursday in a notice filed with California's attorney general. The breach, which began in August, followed an outage spanning several days during which DreamHost reset some customer passwords. The company said hackers exploited an unspecified vulnerability in DreamHost's file manager — the tool customers use to store their files — to obtain session tokens that keep users logged in after authenticating, effectively letting attackers impersonate victims without needing their passwords.

   Technical Details

   According to the breach notice, the file manager flaw allowed hackers to harvest session tokens, which, if stolen, let an attacker access a system as if they were the legitimate logged-in user. A DreamHost spokesperson declined to explain why the company did not detect the intrusion until last week, citing an ongoing investigation, and did not disclose the specific vulnerability exploited. DreamHost said the flaw was unrelated to recently disclosed vulnerabilities in the PHP web software. The spokesperson said the share of affected customers is "well under 10%" of DreamHost's roughly 400,000 paying customers, without giving a precise figure.

   Remediation

   No new remediation guidance beyond DreamHost's prior advice is detailed in this report.

4. bleepingcomputer.com ↗ · pub. 04/11/2026 16:05 · coletado 04/11 18:00

   DreamHost Confirms Data Breach Exposed FTP/SFTP Credentials and Webmail Sessions

   DreamHost's breach notification confirms, for the first time, that the incident was a genuine credential breach rather than a precautionary reset: attackers exploited a vulnerability in third-party software behind its File Manager to steal FTP/SFTP usernames and passwords between August and October 23, 2026, and may also have accessed webmail session information and credentials for a limited number of users, while control panel logins and billing data were not affected.

   ler a análise desta fonte ocultar

   DreamHost's breach notification confirms, for the first time, that the incident was a genuine credential breach rather than a precautionary reset: attackers exploited a vulnerability in third-party software behind its File Manager to steal FTP/SFTP usernames and passwords between August and October 23, 2026, and may also have accessed webmail session information and credentials for a limited number of users, while control panel logins and billing data were not affected.

   DreamHost, a U.S. web hosting provider and domain registrar, has confirmed that attackers exploited a vulnerability in the third-party software behind its web-based File Manager (files.dreamhost.com) to steal customers' FTP/SFTP usernames and passwords, and that the intruder may also have accessed webmail systems, exposing session information and credentials for a limited number of users. In a data breach notification, the company said the intrusion ran from approximately August 2026 until October 23, 2026, when it was discovered, meaning the attacker had unauthorized access for roughly two months. DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing/payment details, which are handled by an external provider. The confirmation follows DreamHost's earlier announcement of a cybersecurity incident that forced email and FTP/SFTP password resets without explaining the cause.

   Technical Details

   According to the breach notification, an unauthorized third party accessed the server running the web-based File Manager and exploited a vulnerability in that software to obtain the FTP/SFTP usernames and passwords of individuals who logged into File Manager between August 2026 and October 23, 2026. The firm said the attack appears deliberate, and its staff worked nonstop to contain it. DreamHost has not named the vulnerable software or assigned a CVE identifier, and BleepingComputer's inquiries about the exact number of impacted accounts went unanswered.

   Remediation

   DreamHost said it has blocked the attackers' access, addressed the exploited vulnerability, stopped active sessions for potentially affected users, and invalidated passwords. Recipients of the breach notification are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where they may have reused the same credentials. To mitigate the risk from this exposure, DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax, and letter recipients are urged to consider placing a fraud alert or a security freeze on their credit report.

5. securityweek.com ↗ · pub. 27/10/2026 09:02 · coletado 27/10 11:00

   DreamHost Suspends File Manager, Resets Email and FTP/SFTP Passwords After Unexplained Incident

   This article adds that DreamHost's notification to account owners was shared on Reddit, and that users publicly speculated whether the reset passwords had been properly hashed amid broader complaints about the company's lack of transparency, details not present in the earlier reporting.

   ler a análise desta fonte ocultar

   This article adds that DreamHost's notification to account owners was shared on Reddit, and that users publicly speculated whether the reset passwords had been properly hashed amid broader complaints about the company's lack of transparency, details not present in the earlier reporting.

   Web hosting provider DreamHost suspended its File Manager service and reset passwords for some email and FTP/SFTP users over the weekend after what it described only as "an issue" with its systems, which affected File Manager at files.dreamhost.com and DreamHost webmail. The company notified account owners via a private communication, also shared on Reddit, explaining that only account owners could set new passwords for affected users since DreamHost could not contact individual mailbox or FTP users directly. DreamHost told account owners that if the old password had been reused elsewhere, it should be changed there too, and it warned that it would never request password resets via email. Users criticized the company's lack of transparency and speculated whether the exposed passwords had been properly hashed, though no details on the number of affected accounts or the root cause were disclosed. DreamHost said it created and deployed a fix for File Manager and restored access to files.dreamhost.com, and was monitoring the situation to ensure full operational status.

   Technical Details

   DreamHost has not disclosed the root cause of the incident or the number of users affected, only stating that it took protective action in response to an unspecified issue impacting File Manager and webmail. The company confirmed it deployed a fix and restored File Manager access by Monday while continuing to monitor the service.

   Remediation

   DreamHost advised affected email and FTP/SFTP users to set new passwords once notified by their account owner, and to change the old password anywhere else it may have been reused. The company reiterated it would never ask customers to reset their password via email, implicitly warning users to be wary of phishing attempts referencing the incident.

6. gbhackers.com ↗ · pub. 27/10/2026 05:52 · coletado 27/10 09:00

   DreamHost Resets Passwords for Email and FTP/SFTP Accounts After File Manager Incident

   This update adds operational detail to the DreamHost incident timeline: on October 25 the company fixed a "Failed to edit" error that had blocked some Professional Email customers from setting replacement passwords, and confirmed by 9:32 p.m. PDT that all impacted account holders had received recovery instructions. It also specifies the exact panel paths account owners must use to reset credentials ("Mail > Manage Email" and "Websites > SFTP Users & Files") and notes a roughly 15-minute propagation delay for new passwords, details not previously captured in the case record.

   ler a análise desta fonte ocultar

   This update adds operational detail to the DreamHost incident timeline: on October 25 the company fixed a "Failed to edit" error that had blocked some Professional Email customers from setting replacement passwords, and confirmed by 9:32 p.m. PDT that all impacted account holders had received recovery instructions. It also specifies the exact panel paths account owners must use to reset credentials ("Mail > Manage Email" and "Websites > SFTP Users & Files") and notes a roughly 15-minute propagation delay for new passwords, details not previously captured in the case record.

   DreamHost forced password resets for certain email and FTP/SFTP accounts following an incident that disrupted its browser-based File Manager and webmail services. The disruption began on October 23, 2026, with connectivity issues in File Manager that later spread to webmail and FTP/SFTP access, prompting precautionary password resets while engineers investigated. DreamHost restored files.dreamhost.com on October 26 at 3:35 p.m. PDT and moved the incident into a monitoring phase, though affected users still need new credentials from their account owners. The company has not disclosed the root cause, the number of affected accounts, or confirmed any unauthorized access or data theft, and stresses that mailboxes continued receiving mail and that FTP/SFTP data remained stored on its servers throughout.

   Technical Details

   DreamHost also resolved a "Failed to edit" error that had prevented some Professional Email customers from setting replacement passwords, according to its October 25 update. On October 25 at 9:32 p.m. PDT, the company said all impacted account holders had received recovery instructions, though individual email and FTP/SFTP users remain unable to authenticate until their account owner assigns and shares new passwords.

   Remediation

   Account owners must sign into the DreamHost panel and reset credentials via "Mail > Manage Email" for email accounts or "Websites > SFTP Users & Files" for FTP/SFTP users, allowing up to 15 minutes for changes to take effect. DreamHost recommends updating any saved credentials in email clients or file-transfer software, using strong unique passwords per account, and reviewing mailbox forwarding settings to remove unrecognized destinations, though this check does not confirm attacker tampering. Affected users should be notified through a phone call, secure text, or another private channel outside their DreamHost-hosted mailbox, and DreamHost reiterates it will never request passwords via email, urging customers to navigate directly to panel.dreamhost.com rather than follow login links in messages.

7. bleepingcomputer.com ↗ · pub. 26/10/2026 16:26 · coletado 26/10 17:00 primeiro registro

   DreamHost Forces Password Resets for Email and FTP/SFTP Users After Unexplained File Manager Incident

   ler a análise desta fonte ocultar

   DreamHost, a U.S. web hosting provider and domain registrar, forced password resets for email and FTP/SFTP users following an incident that began as connectivity problems with its File Manager interface on October 23, 2026, and later expanded to other services including webmail. The company blocked access for all affected users until account owners reset credentials, describing the move as a precaution, and has not disclosed the root cause, the number of impacted accounts, or whether files or messages were actually exposed. DreamHost serves over 400,000 customers in more than 100 countries, supporting at least 1.5 million websites and applications, including 750,000 WordPress installations. Notably, DreamHost advised affected users to review their email accounts for unrecognized forwarding rules, a detail that suggests some mailboxes may have been accessed by unauthorized parties, though the company provided no further confirmation or explanation.

   Technical Details

   DreamHost initially reported connectivity problems with the File Manager interface on October 23, 2026, before the impact spread to other services such as webmail, prompting the company to restrict access across the board (helpnetsecurity.com). Password resets were sent out to affected account owners in batches over the following days, and users remained unable to log in until their account owner manually set new credentials, since DreamHost said it could not contact individual mailbox or FTP users directly. By October 26 at 3:35 p.m. PDT, DreamHost had pushed a fix and restored File Manager access while continuing to monitor the service, though password resets remained required for the affected subset of email and FTP/SFTP accounts (cybersecuritynews.com, helpnetsecurity.com). DreamHost's status page listed File Manager, email hosting, and webmail as disrupted, while website hosting and the main control panel remained operational throughout the incident (cyberinsider.com).

   Remediation

   DreamHost recommended that affected users change any reused passwords on other platforms or services if their old DreamHost credentials had been reused elsewhere. Account owners were urged to audit each email account for unrecognized forwarding destinations and remove them, and to notify individually affected mailbox or FTP users by phone, text, or other out-of-band means since DreamHost could not reach them directly. The company also reiterated that it would never email customers asking for their password, advising users to go directly to the official panel rather than following links in notification emails.

   Conflicting Reports

   DreamHost has not confirmed any credential compromise or data exposure; some coverage emphasizes that the precautionary reset "should not be interpreted as confirmation of a credential breach" (gbhackers.com), while customer complaints and the forwarding-rule guidance cited in the article have led some to speculate that accounts may have been accessed by outside parties. The root cause of the incident remains undisclosed by DreamHost as of publication.