DreamHost Confirms Data Breach Exposed Customer Files, FTP/SFTP Credentials and Webmail Sessions
DreamHost, a U.S. web hosting provider and domain registrar, has confirmed a data breach after initially forcing password resets for email and FTP/SFTP users following an incident that began as connectivity problems with its File Manager interface on October 23, 2026. In a data breach notification filed with California's attorney general, DreamHost said an unauthorized third party exploited a vulnerability in the third-party software running the web-based File Manager (files.dreamhost.com) and accessed customers' FTP/SFTP usernames and passwords, with the intrusion running from approximately August 2026 until October 23, 2026, when it was discovered — roughly two months of unauthorized access (bleepingcomputer.com). DreamHost also confirmed that the intruder may have accessed webmail systems, exposing session information, including credentials, for a limited number of users, but found no evidence that the attacker accessed control panel login information or customer billing/payment details, which are handled by an external provider (bleepingcomputer.com). TechCrunch's reporting further confirmed that hackers also stole customer files stored via the File Manager tool and inbox contents, and that the exploited vulnerability allowed attackers to obtain session tokens — which keep users logged in after authenticating — letting them impersonate victims without needing their passwords (techcrunch.com). DreamHost serves over 400,000 customers in more than 100 countries, supporting at least 1.5 million websites and applications, including 750,000 WordPress installations. DreamHost notified account owners via a private communication, which was also shared publicly on Reddit, stressing that only the account owner could set new passwords for affected email and FTP/SFTP users since DreamHost could not contact them directly, and that DreamHost would never request password resets via email (securityweek.com). DreamHost's public incident notice reiterated that it estimates well under 10% of hosted email and FTP/SFTP accounts were affected, that precautionary notifications reached more customers than investigators currently believe were impacted, and that it does not store full payment card numbers since a third party processes payments (gbhackers.com).
Entenda a falha
A vulnerabilidade
DreamHost says an unauthorized third party exploited an unnamed vulnerability in the third-party software behind its web-based File Manager and gained access to the server running files.dreamhost.com. No CVE, product name, flaw type, affected or fixed versions, or attacker prerequisites have been published. The intruder obtained FTP/SFTP usernames and passwords of people who logged into File Manager from about August 2026 to October 23, 2026. It also reached webmail systems and took session information and credentials for a limited number of users. TechCrunch adds that session tokens and customer files were stolen. DreamHost says it addressed the flaw, found no evidence of control panel login or billing data access, and says the flaw is unrelated to the recent PHP vulnerabilities.
Como funciona
The articles do not describe the technical mechanism. Customers manage website files through the File Manager web interface on files.dreamhost.com, which runs on third-party software. The attacker exploited a flaw in that software and gained access to the server. From there, the attacker could capture the FTP/SFTP credentials that customers entered when logging in to File Manager. The attacker also reached some webmail systems and took session data and credentials. According to TechCrunch, stolen session tokens let an attacker impersonate users without their passwords. The step where the software fails has not been published.
Por que é vulnerável
The root cause has not been disclosed. DreamHost refers only to a vulnerability in third-party software and has not named it. A spokesperson declined to explain why the intrusion went undetected from August until October 23, citing the ongoing investigation. The fix is described only as addressing the exploited vulnerability. DreamHost also rebuilt and relaunched File Manager with extra security precautions and monitoring, rotated potentially exposed internal credentials, and is reviewing other customer-facing tools for similar weaknesses.
Como foi descoberta
DreamHost discovered the unauthorized access on October 23, 2026, when File Manager connectivity problems appeared. It then reset passwords and ended active sessions for potentially affected accounts, and a fix restored File Manager on October 26. The articles do not say who found the flaw or how the intrusion was detected. Early updates called the resets a precaution. A data breach notice filed with California's attorney general, reported on November 4, confirmed exploitation of a vulnerability and credential theft. BleepingComputer counts about two months of access, while TechCrunch's account implies a longer detection gap. DreamHost preserved the server for forensics and engaged outside specialists.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 19:39.
Detalhes técnicos
DreamHost initially reported connectivity problems with the File Manager interface on October 23, 2026, before the impact spread to other services such as webmail, prompting the company to restrict access across the board (helpnetsecurity.com). Password resets were sent out to affected account owners in batches over the following days, and users remained unable to log in until their account owner manually set new credentials, since DreamHost said it could not contact individual mailbox or FTP users directly. By October 26 at 3:35 p.m. PDT, DreamHost had pushed a fix and restored File Manager access while continuing to monitor the service, though password resets remained required for the affected subset of email and FTP/SFTP accounts (cybersecuritynews.com, helpnetsecurity.com). DreamHost's status page listed File Manager, email hosting, and webmail as disrupted, while website hosting and the main control panel remained operational throughout the incident (cyberinsider.com). On October 25, DreamHost resolved a "Failed to edit" error that had prevented some Professional Email customers from setting replacement passwords, and at 9:32 p.m. PDT that day confirmed that all impacted account holders had received recovery instructions, though individual email and FTP/SFTP users remained unable to authenticate until their account owner assigned and shared new passwords (gbhackers.com). In its formal breach notification, DreamHost attributed the intrusion to exploitation of a vulnerability in third-party software powering File Manager, which it said was unrelated to previously identified vulnerabilities in PHP web software, though the company has not named the vulnerable software or assigned it a CVE identifier (cryptonomist.ch). DreamHost said the attack appears deliberate, and its staff worked nonstop to contain it (bleepingcomputer.com). The company estimates that well under approximately 10% of its hosted email and FTP/SFTP accounts were affected, and said the notice was also filed with California's attorney general (cybersecuritynews.com). TechCrunch reported that a DreamHost spokesperson declined to explain why the company did not detect the attack until last week, citing an ongoing investigation, and did not disclose the specific vulnerability exploited; the spokesperson reiterated that the flaw was unrelated to the PHP vulnerabilities and that affected customers remain "well under 10%" of the roughly 400,000 paying customers on its network (techcrunch.com). DreamHost further stated that websites and email remained available throughout the incident, with mailboxes continuing to receive messages even when users could not authenticate, and said its forensic investigation remains ongoing while it notifies applicable regulators and prepares formal customer notices required under relevant national laws (gbhackers.com).
Remediação
DreamHost recommended that affected users change any reused passwords on other platforms or services if their old DreamHost credentials had been reused elsewhere. Account owners were urged to audit each email account for unrecognized forwarding destinations and remove them, and to notify individually affected mailbox or FTP users by phone, text, or other out-of-band means since DreamHost could not reach them directly. The company also reiterated that it would never email customers asking for their password, advising users to go directly to the official panel rather than following links in notification emails. Specifically, account owners must reset credentials via "Mail > Manage Email" for email accounts or "Websites > SFTP Users & Files" for FTP/SFTP users, allowing up to 15 minutes for the changes to take effect, and should update any saved credentials in email clients or file-transfer software (gbhackers.com). DreamHost said it blocked the attackers' access, addressed the exploited vulnerability, stopped active sessions for potentially affected users, and invalidated passwords; it also took the affected File Manager server offline, preserved it for forensic analysis, and rebuilt and relaunched File Manager with additional security precautions and enhanced monitoring, working with outside legal advisors and security and forensics experts (bleepingcomputer.com, gbhackers.com). DreamHost additionally said it rotated potentially exposed internal credentials and began reviewing other customer-facing tools for similar weaknesses (gbhackers.com). Recipients of the notification are advised to check website files for unauthorized changes and review webmail forwarding rules and filters, and DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax, with letter recipients urged to consider a fraud alert or security freeze on their credit report (bleepingcomputer.com).
Relatos divergentes
Earlier coverage of the incident emphasized that DreamHost's precautionary password reset "should not be interpreted as confirmation of a credential breach" (gbhackers.com), while customer complaints and the forwarding-rule guidance cited in prior reporting, along with public speculation over whether passwords were properly hashed, led some to suspect accounts may have been accessed by outside parties (securityweek.com). DreamHost's subsequent data breach notification resolved this uncertainty, confirming that FTP/SFTP credentials were in fact stolen via an exploited vulnerability in File Manager's software, and that webmail session information and credentials for a limited number of users were also exposed, though the company still has not disclosed the specific vulnerability or software involved, nor a precise count of impacted accounts (bleepingcomputer.com). TechCrunch's reporting (techcrunch.com) added that customer files themselves, not only credentials, were stolen, and that DreamHost declined to explain the roughly three-month detection gap between the August intrusion start and the October 23 discovery.
Linha do tempo
-
DreamHost Confirms Data Breach: File Manager Flaw Exposed FTP/SFTP and Webmail Credentials
This DreamHost advisory adds that the company rotated potentially exposed internal credentials and began reviewing other customer-facing tools for similar weaknesses, is notifying applicable regulators and preparing formal customer notices under relevant national laws (beyond the California attorney general filing already known), and that websites and email remained available throughout, with mailboxes continuing to receive messages even when users could not authenticate; the forensic investigation remains ongoing.
ler a análise desta fonte ocultar
This DreamHost advisory adds that the company rotated potentially exposed internal credentials and began reviewing other customer-facing tools for similar weaknesses, is notifying applicable regulators and preparing formal customer notices under relevant national laws (beyond the California attorney general filing already known), and that websites and email remained available throughout, with mailboxes continuing to receive messages even when users could not authenticate; the forensic investigation remains ongoing.
DreamHost has confirmed a security breach in which attackers exploited a vulnerability in third-party software powering its browser-based File Manager, exposing FTP/SFTP usernames and passwords as well as credentials for a limited number of webmail users. The company discovered unauthorized access on October 23, 2026, to the server running files.dreamhost.com, and believes attackers may have viewed the contents of some mailboxes. Customers who used File Manager between approximately August 2026 and October 23 should treat their FTP/SFTP credentials as compromised. DreamHost estimates the incident affected well under 10% of hosted email and FTP/SFTP accounts and found no evidence that control panel logins or billing/payment data were accessed, noting it does not store full card numbers since a third party processes payments.
Technical Details
DreamHost reset affected passwords and terminated active sessions the day it discovered the intrusion, removed the affected File Manager servers from service, and preserved the compromised server for forensic analysis before rebuilding and relaunching File Manager with additional security precautions and enhanced monitoring. The company said websites and email remained available throughout the incident, with mailboxes continuing to receive messages even when users could not authenticate, and stated the breach was unrelated to recent PHP server updates. Its forensic investigation remains ongoing, and it is notifying applicable regulators and preparing formal customer notices required under relevant national laws.
Remediation
Only the DreamHost account holder can assign replacement passwords through the account control panel, with changes taking up to 15 minutes to become effective; customers should update saved credentials in email and file-transfer applications and replace reused or similar passwords elsewhere. Administrators should inspect website files for unfamiliar modifications and review mailbox forwarding rules and filters, and follow phishing-prevention practices when handling unsolicited messages requesting credentials. DreamHost warned that its incident emails never request passwords or direct recipients to sign in through links, and said it rotated potentially exposed internal credentials, engaged outside security and forensic specialists, and began reviewing other customer-facing tools for similar weaknesses.
-
DreamHost Confirms Hackers Stole Customer Files and Inboxes in Months-Long Breach
The article confirms that attackers not only harvested credentials but also stole customer files stored via DreamHost's file manager and accessed inbox contents, and clarifies that the compromised session tokens allowed attackers to impersonate logged-in users without needing passwords. It also notes DreamHost declined to explain why detection took so long and reiterates the breach began in August and affects well under 10% of its roughly 400,000 paying customers.
ler a análise desta fonte ocultar
The article confirms that attackers not only harvested credentials but also stole customer files stored via DreamHost's file manager and accessed inbox contents, and clarifies that the compromised session tokens allowed attackers to impersonate logged-in users without needing passwords. It also notes DreamHost declined to explain why detection took so long and reiterates the breach began in August and affects well under 10% of its roughly 400,000 paying customers.
DreamHost has confirmed that attackers stole customer files and inbox contents during a months-long intrusion into its systems, disclosed last Thursday in a notice filed with California's attorney general. The breach, which began in August, followed an outage spanning several days during which DreamHost reset some customer passwords. The company said hackers exploited an unspecified vulnerability in DreamHost's file manager — the tool customers use to store their files — to obtain session tokens that keep users logged in after authenticating, effectively letting attackers impersonate victims without needing their passwords.
Technical Details
According to the breach notice, the file manager flaw allowed hackers to harvest session tokens, which, if stolen, let an attacker access a system as if they were the legitimate logged-in user. A DreamHost spokesperson declined to explain why the company did not detect the intrusion until last week, citing an ongoing investigation, and did not disclose the specific vulnerability exploited. DreamHost said the flaw was unrelated to recently disclosed vulnerabilities in the PHP web software. The spokesperson said the share of affected customers is "well under 10%" of DreamHost's roughly 400,000 paying customers, without giving a precise figure.
Remediation
No new remediation guidance beyond DreamHost's prior advice is detailed in this report.
-
DreamHost Confirms Data Breach Exposed FTP/SFTP Credentials and Webmail Sessions
DreamHost's breach notification confirms, for the first time, that the incident was a genuine credential breach rather than a precautionary reset: attackers exploited a vulnerability in third-party software behind its File Manager to steal FTP/SFTP usernames and passwords between August and October 23, 2026, and may also have accessed webmail session information and credentials for a limited number of users, while control panel logins and billing data were not affected.
ler a análise desta fonte ocultar
DreamHost's breach notification confirms, for the first time, that the incident was a genuine credential breach rather than a precautionary reset: attackers exploited a vulnerability in third-party software behind its File Manager to steal FTP/SFTP usernames and passwords between August and October 23, 2026, and may also have accessed webmail session information and credentials for a limited number of users, while control panel logins and billing data were not affected.
DreamHost, a U.S. web hosting provider and domain registrar, has confirmed that attackers exploited a vulnerability in the third-party software behind its web-based File Manager (files.dreamhost.com) to steal customers' FTP/SFTP usernames and passwords, and that the intruder may also have accessed webmail systems, exposing session information and credentials for a limited number of users. In a data breach notification, the company said the intrusion ran from approximately August 2026 until October 23, 2026, when it was discovered, meaning the attacker had unauthorized access for roughly two months. DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing/payment details, which are handled by an external provider. The confirmation follows DreamHost's earlier announcement of a cybersecurity incident that forced email and FTP/SFTP password resets without explaining the cause.
Technical Details
According to the breach notification, an unauthorized third party accessed the server running the web-based File Manager and exploited a vulnerability in that software to obtain the FTP/SFTP usernames and passwords of individuals who logged into File Manager between August 2026 and October 23, 2026. The firm said the attack appears deliberate, and its staff worked nonstop to contain it. DreamHost has not named the vulnerable software or assigned a CVE identifier, and BleepingComputer's inquiries about the exact number of impacted accounts went unanswered.
Remediation
DreamHost said it has blocked the attackers' access, addressed the exploited vulnerability, stopped active sessions for potentially affected users, and invalidated passwords. Recipients of the breach notification are advised to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where they may have reused the same credentials. To mitigate the risk from this exposure, DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax, and letter recipients are urged to consider placing a fraud alert or a security freeze on their credit report.
-
DreamHost Suspends File Manager, Resets Email and FTP/SFTP Passwords After Unexplained Incident
This article adds that DreamHost's notification to account owners was shared on Reddit, and that users publicly speculated whether the reset passwords had been properly hashed amid broader complaints about the company's lack of transparency, details not present in the earlier reporting.
ler a análise desta fonte ocultar
This article adds that DreamHost's notification to account owners was shared on Reddit, and that users publicly speculated whether the reset passwords had been properly hashed amid broader complaints about the company's lack of transparency, details not present in the earlier reporting.
Web hosting provider DreamHost suspended its File Manager service and reset passwords for some email and FTP/SFTP users over the weekend after what it described only as "an issue" with its systems, which affected File Manager at files.dreamhost.com and DreamHost webmail. The company notified account owners via a private communication, also shared on Reddit, explaining that only account owners could set new passwords for affected users since DreamHost could not contact individual mailbox or FTP users directly. DreamHost told account owners that if the old password had been reused elsewhere, it should be changed there too, and it warned that it would never request password resets via email. Users criticized the company's lack of transparency and speculated whether the exposed passwords had been properly hashed, though no details on the number of affected accounts or the root cause were disclosed. DreamHost said it created and deployed a fix for File Manager and restored access to files.dreamhost.com, and was monitoring the situation to ensure full operational status.
Technical Details
DreamHost has not disclosed the root cause of the incident or the number of users affected, only stating that it took protective action in response to an unspecified issue impacting File Manager and webmail. The company confirmed it deployed a fix and restored File Manager access by Monday while continuing to monitor the service.
Remediation
DreamHost advised affected email and FTP/SFTP users to set new passwords once notified by their account owner, and to change the old password anywhere else it may have been reused. The company reiterated it would never ask customers to reset their password via email, implicitly warning users to be wary of phishing attempts referencing the incident.
-
DreamHost Resets Passwords for Email and FTP/SFTP Accounts After File Manager Incident
This update adds operational detail to the DreamHost incident timeline: on October 25 the company fixed a "Failed to edit" error that had blocked some Professional Email customers from setting replacement passwords, and confirmed by 9:32 p.m. PDT that all impacted account holders had received recovery instructions. It also specifies the exact panel paths account owners must use to reset credentials ("Mail > Manage Email" and "Websites > SFTP Users & Files") and notes a roughly 15-minute propagation delay for new passwords, details not previously captured in the case record.
ler a análise desta fonte ocultar
This update adds operational detail to the DreamHost incident timeline: on October 25 the company fixed a "Failed to edit" error that had blocked some Professional Email customers from setting replacement passwords, and confirmed by 9:32 p.m. PDT that all impacted account holders had received recovery instructions. It also specifies the exact panel paths account owners must use to reset credentials ("Mail > Manage Email" and "Websites > SFTP Users & Files") and notes a roughly 15-minute propagation delay for new passwords, details not previously captured in the case record.
DreamHost forced password resets for certain email and FTP/SFTP accounts following an incident that disrupted its browser-based File Manager and webmail services. The disruption began on October 23, 2026, with connectivity issues in File Manager that later spread to webmail and FTP/SFTP access, prompting precautionary password resets while engineers investigated. DreamHost restored files.dreamhost.com on October 26 at 3:35 p.m. PDT and moved the incident into a monitoring phase, though affected users still need new credentials from their account owners. The company has not disclosed the root cause, the number of affected accounts, or confirmed any unauthorized access or data theft, and stresses that mailboxes continued receiving mail and that FTP/SFTP data remained stored on its servers throughout.
Technical Details
DreamHost also resolved a "Failed to edit" error that had prevented some Professional Email customers from setting replacement passwords, according to its October 25 update. On October 25 at 9:32 p.m. PDT, the company said all impacted account holders had received recovery instructions, though individual email and FTP/SFTP users remain unable to authenticate until their account owner assigns and shares new passwords.
Remediation
Account owners must sign into the DreamHost panel and reset credentials via "Mail > Manage Email" for email accounts or "Websites > SFTP Users & Files" for FTP/SFTP users, allowing up to 15 minutes for changes to take effect. DreamHost recommends updating any saved credentials in email clients or file-transfer software, using strong unique passwords per account, and reviewing mailbox forwarding settings to remove unrecognized destinations, though this check does not confirm attacker tampering. Affected users should be notified through a phone call, secure text, or another private channel outside their DreamHost-hosted mailbox, and DreamHost reiterates it will never request passwords via email, urging customers to navigate directly to panel.dreamhost.com rather than follow login links in messages.
-
DreamHost Forces Password Resets for Email and FTP/SFTP Users After Unexplained File Manager Incident
ler a análise desta fonte ocultar
DreamHost, a U.S. web hosting provider and domain registrar, forced password resets for email and FTP/SFTP users following an incident that began as connectivity problems with its File Manager interface on October 23, 2026, and later expanded to other services including webmail. The company blocked access for all affected users until account owners reset credentials, describing the move as a precaution, and has not disclosed the root cause, the number of impacted accounts, or whether files or messages were actually exposed. DreamHost serves over 400,000 customers in more than 100 countries, supporting at least 1.5 million websites and applications, including 750,000 WordPress installations. Notably, DreamHost advised affected users to review their email accounts for unrecognized forwarding rules, a detail that suggests some mailboxes may have been accessed by unauthorized parties, though the company provided no further confirmation or explanation.
Technical Details
DreamHost initially reported connectivity problems with the File Manager interface on October 23, 2026, before the impact spread to other services such as webmail, prompting the company to restrict access across the board (helpnetsecurity.com). Password resets were sent out to affected account owners in batches over the following days, and users remained unable to log in until their account owner manually set new credentials, since DreamHost said it could not contact individual mailbox or FTP users directly. By October 26 at 3:35 p.m. PDT, DreamHost had pushed a fix and restored File Manager access while continuing to monitor the service, though password resets remained required for the affected subset of email and FTP/SFTP accounts (cybersecuritynews.com, helpnetsecurity.com). DreamHost's status page listed File Manager, email hosting, and webmail as disrupted, while website hosting and the main control panel remained operational throughout the incident (cyberinsider.com).
Remediation
DreamHost recommended that affected users change any reused passwords on other platforms or services if their old DreamHost credentials had been reused elsewhere. Account owners were urged to audit each email account for unrecognized forwarding destinations and remove them, and to notify individually affected mailbox or FTP users by phone, text, or other out-of-band means since DreamHost could not reach them directly. The company also reiterated that it would never email customers asking for their password, advising users to go directly to the official panel rather than following links in notification emails.
Conflicting Reports
DreamHost has not confirmed any credential compromise or data exposure; some coverage emphasizes that the precautionary reset "should not be interpreted as confirmation of a credential breach" (gbhackers.com), while customer complaints and the forwarding-rule guidance cited in the article have led some to speculate that accounts may have been accessed by outside parties. The root cause of the incident remains undisclosed by DreamHost as of publication.