Threat watch / Breach
DreamHost: File Manager breach exposes FTP/SFTP passwords and some webmail logins
DreamHost says an attacker exploited a vulnerability in the third-party software behind its browser-based File Manager and took FTP/SFTP credentials, plus webmail logins for a limited number of users. Passwords were reset and webmail sessions ended. The investigation is ongoing.
- Sector
- Tech & SaaS
- Way in
- Software flaw
- Product or vendor
- DreamHost
- How it happened
- By exploiting a vulnerability in the third-party software that File Manager is built on, then reaching certain webmail systems. DreamHost calls it "a deliberate attack". It does not name the software or the vulnerability.[1] Checked 8 Nov 2026
- What was stolen
- FTP/SFTP usernames and passwords of users who logged into File Manager between about August 2026 and 23 October, and webmail logins for a limited number of users. In a small number of cases the attacker may have viewed mailbox contents. DreamHost says it found no evidence of access to control panel logins or billing details.[1] Checked 8 Nov 2026
- Who was impacted
- "Well under approximately 10%" of DreamHost email and FTP/SFTP accounts, according to DreamHost; no user count is given. Affected users were locked out until the account owner reset passwords. Websites and email stayed available.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- DreamHost sees File Manager and some webmail logins failing, takes File Manager offline and starts resetting passwords that evening. [1][2]
- Help Net Security reports that a fix is deployed and File Manager is back, while a subset of email and FTP/SFTP accounts still need password resets. DreamHost had not disclosed the cause. [2]
- DreamHost publishes its incident notice: vulnerability in third-party software, credentials exposed, File Manager rebuilt, regulators being notified. The investigation continues. [1]