A breach of DreamHost's File Manager exposed credentials used to access customer websites and webmail accounts.
The hosting provider confirmed that an attacker exploited a vulnerability in its browser-based File Manager, exposing FTP/SFTP usernames and passwords alongside credentials for some webmail users. DreamHost discovered the intrusion on October 23, 2026, with the potential credential-exposure period extending back to approximately August 2026.
DreamHost has reset potentially exposed passwords and terminated affected sessions. However, administrators still need to determine whether attackers accessed sensitive files, modified website content, or viewed private communications.
How attackers exploited DreamHost's File Manager
According to DreamHost's October 29 security disclosure, the attacker exploited an unspecified vulnerability in third-party software powering File Manager at files.dreamhost.com.
The attacker obtained FTP/SFTP credentials belonging to users who accessed the tool during the affected period. Those credentials could permit unauthorized file access or modifications, depending on account permissions. A Dropbox breach involving Lenovo ID authentication similarly demonstrated how compromised access controls can put hosted files at risk.
The DreamHost intrusion also reached webmail systems. Login credentials for a limited number of users were exposed, and the company believes mailbox contents may have been viewed in some cases.
According to BleepingComputer's November 4 report, webmail session information may also have been exposed. Valid session tokens can potentially allow unauthorized access without reentering passwords, a risk also illustrated by the Chainalysis breach involving live authentication tokens.
DreamHost estimates that well under 10% of its hosted email and FTP/SFTP accounts were affected. It has not released an exact count.
The company found no evidence of compromised control-panel credentials or billing information.
After discovering the attack, DreamHost disabled File Manager, reset potentially exposed passwords, and terminated affected sessions. It subsequently rebuilt the service with additional security controls. The exploited vulnerability has not been publicly identified.
Security checks for affected hosting accounts
Although DreamHost says it has addressed the vulnerability, affected organizations should investigate possible unauthorized activity. Account owners must establish replacement passwords for affected users through the hosting control panel.
The mSecure credential-security incident reinforces the need to examine other potentially exposed secrets rather than relying solely on password resets.
Security teams should prioritize these measures:
- Reset credentials and verify sessions: Replace potentially exposed or reused passwords, update saved credentials, and confirm affected sessions are invalidated.
- Investigate activity and preserve evidence: Examine available access logs for suspicious connections or file changes, preserving relevant evidence before remediation.
- Audit accounts and permissions: Check FTP/SFTP users, SSH keys, and webmail forwarding rules for unauthorized additions or changes.
- Rotate potentially exposed secrets: Replace database passwords, API tokens, and application credentials if they were stored in potentially accessible files. Enable multifactor authentication where supported.
- Verify website integrity and recovery: Compare hosted files against trusted backups, investigate unexpected modifications, and test restoration procedures.
- Test incident response plans: Exercise credential-compromise scenarios and validate containment, escalation, notification, and recovery processes.
DreamHost also warned customers about phishing emails impersonating its security notifications. Administrators should access the hosting control panel directly instead of following unexpected sign-in links.
Eligible affected individuals are being offered one year of Equifax identity-theft protection, according to DreamHost's breach notifications.
DreamHost has not disclosed the exact number of affected accounts or the full extent of unauthorized access. Administrators should verify credential resets and investigate potential website-file or mailbox compromise.
More cybersecurity news: A Microsoft 365 passkey phishing campaign demonstrates how attackers can exploit authentication workflows to compromise business accounts and access cloud data.