DreamHost Breach May Expose Customer FTP Passwords
Hosting customers who used the File Manager during the exposure window face possible credential theft, with the affected account count still undisclosed.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust online hosting companies to keep your account data secure?
Web hosting provider DreamHost disclosed a security breach in which an unauthorized party accessed its web-based File Manager and may have obtained customers' FTP/SFTP usernames and passwords, along with webmail session information for a limited number of users. The incident is a confirmed security event, not a projection; DreamHost has not disclosed how many accounts were affected.
Why it matters
The intrusion exploited a vulnerability in the software running files.dreamhost.com, a reminder that file-management services that sit between customers and their stored data remain a high-value attack surface. Because the exposed credentials are the keys to hosted websites and files, the breach shows how a single flaw in a hosting provider's web tooling can cascade into downstream account risk.
The disclosure names a specific entry point: a vulnerability in the software running DreamHost's File Manager at files.dreamhost.com. The company has not published a figure for affected accounts, so the scale of exposure cannot be measured against its customer base.
The players
DreamHost
A long-established web hosting company that provides shared and managed hosting, domain registration and the File Manager service at the center of this incident.
Equifax
A major U.S. consumer credit reporting agency whose credit monitoring product DreamHost is offering to affected customers.
The details
An attacker reached DreamHost's web-based File Manager, which lets customers manage files stored on the company's servers through a browser. The attacker exploited a flaw in the software that runs the service, and FTP (File Transfer Protocol) and SFTP (its encrypted successor) credentials, the username-and-password pairs customers use to upload files, may have been read for anyone who logged in during the exposure window. DreamHost says it cut off the attacker's access, patched the vulnerability, ended active sessions for potentially affected users, and invalidated their passwords, which forces those users to set new ones.
Timeline
August 2026: The intrusion into DreamHost systems began.
October 23, 2026: DreamHost discovered the breach.
The Tech Race
The incident points to the file-management layer of hosting platforms, where a single vulnerability can expose the login credentials that customers use across their sites. It is a story about how a web-based control surface, rather than the core server infrastructure, became the point of entry.
Customers who logged into DreamHost's File Manager during the exposure period should treat their FTP/SFTP passwords as compromised and expect DreamHost to have ended their active sessions and invalidated their passwords. Affected users may also want to review any webmail sessions and consider the one year of Equifax credit monitoring DreamHost is offering.
The takeaway
The practical lesson is that hosting customers should rotate FTP/SFTP credentials and watch for account notices from DreamHost, which has not yet said how many accounts were touched. The next concrete signal to watch is whether the company publishes an affected-account count or a technical root-cause description of the File Manager vulnerability.
Further reading
For more on how breaches like this unfold across the hosting industry, explore our Cybersecurity coverage.
Live Poll
Do you trust online hosting companies to keep your account data secure?
