DreamHost Says Attackers Had Access to Its File Manager From August to Oct. 23, Taking FTP Logins

DreamHost says an unauthorized party sat inside the server running its browser-based File Manager for about two months before anyone noticed.

The web host and domain registrar disclosed the breach on Thursday, Oct. 29. A data breach notice filed with the California attorney general puts the intrusion between approximately August 2026 and Oct. 23, 2026, the day DreamHost found it.

What the attacker got

DreamHost's notification says the attacker exploited a vulnerability in software on the server behind files.dreamhost.com. That gave access to the FTP/SFTP usernames and passwords of anyone who logged into the File Manager during that window.

The notice also says the attacker obtained session tokens. Those are the digital keys that keep a user logged in after a password is entered. Someone holding a stolen token can act as that user.

The intruder also reached certain webmail systems. DreamHost says it exposed session information, including login credentials, for a limited number of webmail users. In a small number of cases, the company believes the attacker may have viewed mailbox contents. DreamHost says it is contacting those customers one by one.

DreamHost calls the incident a deliberate attack.

How many customers

A DreamHost spokesperson told TechCrunch the number of affected customers is well under 10%, and the company's own announcement describes a fraction of hosted email and FTP/SFTP accounts, also well under 10%. DreamHost has not given an exact figure. It says it has about 400,000 paying customers across its network.

The company also says its investigation shows fewer customers were affected than it first suspected. Not everyone who received the initial password-reset email was compromised, according to the announcement.

What DreamHost says wasn't touched

DreamHost says it found no evidence that the attacker accessed control panel logins or customer billing details. It says it does not store full payment card numbers, which a third-party processor handles.

The company says it has blocked the attacker's access and fixed the exploited vulnerability. It also says it ended active sessions for potentially affected users and invalidated their passwords. The compromised server was taken out of service and preserved for forensic investigation.

DreamHost says websites and email stayed available throughout. Mailboxes kept receiving mail even while their owners could not sign in.

The timeline

The public first saw this on or around Oct. 26, when DreamHost began expiring passwords for some email and FTP/SFTP users and told account owners to set new ones. The company shut down the File Manager on Oct. 23. The full explanation, including the August start date, came with the Oct. 29 announcement and the California filing.

That leaves a gap of roughly two months between the start of the intrusion and its discovery. A spokesperson declined to tell TechCrunch why DreamHost did not detect the attack sooner, citing the ongoing investigation.

The spokesperson also did not identify the vulnerability. DreamHost describes the File Manager as built on third-party software and has not named it. The company says the flaw has nothing to do with the recent PHP security updates.

What affected customers are being told

Affected mail, FTP and SFTP accounts stay active, but their users cannot sign in until the account owner sets a new password in the control panel. DreamHost says a user may be affected in two situations, and that neither one automatically means compromise. If a previously working password still works and was never changed, the company's investigation indicates it was not exposed. It still urges people to change it.

DreamHost recommends that customers:

• Check website files for changes they don't recognize.
• Review webmail forwarding rules and filters.
• Change passwords on any other accounts that share the same credentials.

The forwarding-rule advice matters. An attacker with mailbox access can quietly redirect mail without needing the password again.

Customers who store information about their own clients may want to consult legal advisors about their own obligations, the company said. The company also reminded users that it never asks for passwords by email and that its incident emails never ask people to sign in through a link.

Recipients of the breach letters get one year of credit monitoring and identity theft protection through Equifax. The notice urges them to consider a fraud alert or a security freeze on their credit reports.

Still unanswered

DreamHost's investigation is ongoing. The company has not said which software was exploited, why monitoring missed an intruder for about two months, or exactly how many accounts were hit.

Those answers decide how much risk customers carry. A site owner whose FTP credentials were taken in August has had weeks in which an attacker could have altered files undetected, which is why DreamHost is telling customers to inspect their website files now.