---
title: DreamHost confirms attackers exploited its web File Manager from about August to Oct 23, stealing FTP/SFTP logins and some webmail sessions | ctxsec
url: https://ctxsec.com/items/dreamhost-breach-notice-file-manager-exploited-ftp-credentials-aug-oct-2026
description: "DreamHost's breach notice, filed with the California Attorney General, says an unauthorized party exploited a vulnerability in the server that runs its web-based File Manager (files.dreamhost.com). That exposed the FTP/SFTP usernames and passwords of people who logged into the File Manager between about August 2026 and Oct 23. The attacker also reached some webmail systems, which may have exposed session credentials for a limited number of webmail users. DreamHost says email contents and files on FTP/SFTP may also have been accessed. It found no evidence that control panel logins or billing details were accessed. This explains the Oct 23-25 forced password resets we covered earlier."
status: "official (DreamHost breach notice letter filed with the California AG)"
published: 2026-11-04
---

> DreamHost's breach notice, filed with the California Attorney General, says an unauthorized party exploited a vulnerability in the server that runs its web-based File Manager (files.dreamhost.com). That exposed the FTP/SFTP usernames and passwords of people who logged into the File Manager between about August 2026 and Oct 23. The attacker also reached some webmail systems, which may have exposed session credentials for a limited number of webmail users. DreamHost says email contents and files on FTP/SFTP may also have been accessed. It found no evidence that control panel logins or billing details were accessed. This explains the Oct 23-25 forced password resets we covered earlier.

[← Cybersecurity News](/news) · [markdown](/items/dreamhost-breach-notice-file-manager-exploited-ftp-credentials-aug-oct-2026.md)

official (DreamHost breach notice letter filed with the California AG)

2026-11-04

### DreamHost confirms attackers exploited its web File Manager from about August to Oct 23, stealing FTP/SFTP logins and some webmail sessions

- **If you host there:** assume any password typed into files.dreamhost.com since August is burned. Rotate it (and anywhere you reused it), check site files for unexpected changes or web shells, and remove unknown mail forwarding rules and filters, as DreamHost advises.
- DreamHost says it fixed the vulnerability, ended active sessions and reset passwords. It is offering one year of credit monitoring.
- **Not disclosed:** how many accounts were affected and what the File Manager vulnerability was.

Sources: [DreamHost Notice of Data Breach (letter filed with California AG)](https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf) · [BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions (Nov 4)](https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/)