- DreamHost says an intruder exploited a flaw on its File Manager server and could access FTP/SFTP logins of users who logged in between about August and October 23, 2026.
- DreamHost says the intruder may also have reached webmail. It has not described the flaw, and BleepingComputer got no answer on how many accounts are affected.
- DreamHost advises checking website files for unauthorized changes, reviewing webmail forwarding rules and filters, and changing any reused passwords.
What was exposed at DreamHost
A password reset stops an intruder's access from today. It cannot show what happened during the two months before. That gap is the question this notice leaves open.
DreamHost has told customers that an unauthorized third party got into the server behind its browser-based File Manager. The intruder used a software flaw on that server. DreamHost says this gave them access to the FTP/SFTP usernames and passwords of people who logged in to the tool. FTP and SFTP are standard ways to send files to a website.
DreamHost puts the exposure at approximately August 2026 until October 23, 2026, the day it found the breach. BleepingComputer, which reported the notice, describes this as two months of access. The start date is approximate, so the length is too.
DreamHost also says the intruder may have reached its webmail systems. If so, session information, including credentials, could have been exposed for a limited number of users. The company says the attack appears deliberate.
So far, DreamHost says, nothing shows the attacker touched control panel logins or customer billing and payment details. An outside provider handles billing. The company says it has shut the attacker out and dealt with the flaw. It also ended live sessions for users who may have been affected and made their old passwords unusable.
DreamHost is also offering affected people one year of Equifax credit monitoring and identity theft protection. Letter recipients are urged to consider a fraud alert or a security freeze on their credit report.
What is still unknown
DreamHost has not published what the flaw was. It has not said whether credentials were captured at login or reached some other way. BleepingComputer says it contacted DreamHost several times about the number of affected accounts and got no reply.
The reporting does not say that any customer website was changed. It also does not say that anyone used the exposed logins.
Why a file manager login matters
This section is our reasoning, not DreamHost's account. A browser-based file manager has to pass your login to its server so the server can connect for you. That makes the server a place where logins gather.
An FTP or SFTP login lets its holder work with the files that make up a site. The notice does not say which of the two affected users relied on.
Password reuse widens the exposure. If the same password protects email or another service, anyone holding it could try it there. That is why DreamHost tells recipients to change passwords on any other account that shares the same credentials.
DreamHost also advises recipients to check website files for unauthorized changes. It suggests reviewing webmail forwarding rules and filters. These are precautions. DreamHost has not said that files were altered or that forwarding rules were created.
The idea: account for the window, not only the reset
The lesson here is that a reset answers one question and leaves another open. It tells you old passwords no longer work. It does not tell you what happened between August and October 23.
By BleepingComputer's account, the attacker had access to the File Manager platform for two months. DreamHost says the intruder could access the logins of people who signed in during that time. This is one incident. It is not evidence of a pattern across hosting providers.
Picture a small business owner who logged in once in September to fix a page. That person falls inside the window. They may have forgotten the login by now.
What leaders should ask their teams
If your organisation hosts with DreamHost, first find out whether anyone received the notice. Agencies and contractors often hold hosting logins, so ask them directly.
Then put five questions to your team.
First, did anyone log in to the File Manager between August and October 23, 2026? Second, who is checking website files for changes, and against what known-good copy? Third, has someone reviewed webmail forwarding rules and filters on affected mailboxes? Fourth, are the hosting passwords used on any other account? Fifth, does your site need FTP logins at all, or could deployments use a narrower, separate account?
A review of the period before the reset is how you would learn what happened in those two months.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
