Overview
- DreamHost says an unauthorized actor accessed the server behind files.dreamhost.com from August 2026 until the intrusion was discovered on October 23, 2026, and the company took the File Manager offline to contain the incident.
- The company reports attackers exploited a vulnerability in its web-based File Manager to capture FTP and SFTP usernames and passwords for users who logged into the tool during that period.
- DreamHost says a limited number of webmail sessions may also have been exposed, with session tokens or credentials captured for some users.
- In response DreamHost says it blocked the attacker, patched the vulnerable software, terminated active sessions, invalidated or forced resets of affected passwords, and offered one year of Equifax credit monitoring while outside forensics and legal advisors continue the investigation with no current evidence of control panel or billing data access.
- Customers who had passwords reset may have lost temporary access and are being urged to check site files and email forwarding rules, change any reused passwords, and monitor accounts for phishing or unauthorized activity.