2026 DreamHost — attacker reached File Manager servers; FTP logins and some webmail credentials exposed; company says well under 10% of email and FTP accounts affected
Data compromised
FTP and SFTP usernames and passwords for users who logged into File Manager before detection. Login credentials for a limited number of webmail users, which the attacker may have used to view mailbox contents. DreamHost is contacting those customers individually. It says it found no evidence that control panel logins or billing details were accessed and that it does not store full card numbers. It says affected accounts are a fraction of email and FTP/SFTP accounts, well under about 10 percent, and it has not given a count.
Technical writeup
Root cause
On Friday, October 23, 2026, an unauthorized third party accessed the server that runs DreamHost's web-based File Manager, by exploiting a flaw in third-party software. The attacker also reached certain webmail systems. DreamHost took the File Manager servers offline, reset passwords for affected users, ended their sessions, rebuilt File Manager with added safeguards and rotated internal credentials. It has retained outside forensic experts. DreamHost calls the attack deliberate but has not named an actor.