- DreamHost discloses breach exposing FTP/SFTP credentials and some webmail account session data
- Attackers exploited a vulnerability in the company’s File Manager service to access customer accounts
- DreamHost reset affected passwords, offered credit monitoring, and urged users to strengthen account security
Popular web hosting provider DreamHost has confirmed threat actors walked away with login credentials to its customers’ hosting accounts, as well as webmail accounts.
It is now urging organizations to take steps to protect themselves, as it works to tighten up on security and make sure these things never happen again.
In a copy of a data breach notification letter sent to affected organizations, DreamHost said that roughly two weeks ago it discovered unauthorized third-party access to the server that runs its web-based File manager at files.DreamHost.com.
Access to the manager was compromised during August 2026, the company further said, adding that the threat actors walked in by exploiting a vulnerability in that software.
Payment data secure
The flaw, which the company did not detail or describe, granted the attackers access to FTP/SFTP usernames and passwords of logged-in individuals. Furthermore, they were able to reach some webmail systems and grab session information – including credentials – of a “limited number” of webmail users.
Cybercriminals having access to login credentials means that whatever information is stored inside File Manager and the webmail should also be considered compromised. Furthermore, it means the emails can be used to disseminate spam, launch phishing attacks, or even engage in highly disruptive Business Email Compromise (BEC) attacks that could be almost impossible to detect.
DreamHost did not discuss the identity of the attackers, and did not say if they reached out with an extortion attempt. “We believe this as a deliberate attack, and our team worked around the clock to contain it,” is all it said on the matter.
The investigation is still ongoing so the information is inconclusive, but DreamHost said there is currently no evidence that the attackers accessed control panel login information or customer billing details. The company allegedly doesn’t store full payment card numbers and only retains a secure token representing the payment card information. This token cannot be used to make purchases elsewhere.
“However, our investigation is ongoing, and if we discover any significant additional information, we will update this post,” DreamHost said.
DreamHost’s response
In response to the incident, DreamHost said it “took steps” to stop the attackers from further accessing its systems, and to address the exploited vulnerability.
Active sessions of users who may have been affected have been terminated, and their passwords were reset. Therefore, if you try to log into your DreamHost account and see that the password was reset, consider your data breached. DreamHost claims to have implemented “additional security measures” to prevent such incidents from happening again, although it did not say exactly what was done.
“DreamHost also is working closely with outside legal advisors and security and forensics experts to ensure the incident is properly addressed,” it said.
In the meantime, it urged customers to review their statements and notify the police of any suspicious activity, as well as to obtain and monitor their credit card reports. The company also advised users place a fraud alert on their credit report. Detailed steps on what customers can do to defend themselves can be found on this link.
Finally, DreamHost offered all affected individuals one year of free credit report monitoring and identity theft protection services through Equifax which is more or less standard practice in these situations.
So far, no threat actors claimed responsibility for the breach, and the data has not yet leaked to the dark web.
This is not the first cybersecurity incident DreamHost has experienced. In 2012, attackers gained access to one of its database servers, potentially exposing customer FTB and shell-access passwords. The company responded by resetting affected passwords, although it reported no evidence of significant malicious activity against customer accounts. Five years later, in 2017, the company suffered a major Distributed Denial of Service (DDoS) attack against its DNS infrastructure, resulting in widespread connectivity issues for customers.
