DreamHost confirms breach that exposed FTP/SFTP and webmail credentials (2026)

On 5 November 2026, details emerged of a breach that DreamHost — the Brea, California web-hosting provider operated by New Dream Network — had disclosed after discovering unauthorised third-party access to the server running its web-based File Manager. The company said it detected the intrusion on 23 October 2026 and believes the attacker exploited an unidentified vulnerability in the third-party software powering File Manager. Exposure of the affected credentials may stretch back to around August 2026.

What was exposed

According to DreamHost's notice, the stolen data includes FTP/SFTP usernames and passwords for users who accessed File Manager during the affected period, along with login credentials and session information for a limited number of webmail users. Valid webmail session tokens could, in principle, allow access to a mailbox without re-entering a password, and DreamHost is contacting individually those customers whose mailbox contents investigators believe may have been viewed. The company said it found no evidence that control-panel credentials or billing information were compromised, and estimated that well under 10% of its hosted email and FTP/SFTP accounts were affected.

Response

DreamHost disabled File Manager, reset potentially exposed passwords, terminated affected sessions, and rebuilt the service with additional security controls. It offered eligible affected individuals one year of Equifax identity-theft protection and warned customers to watch for phishing emails impersonating its own security notifications. No threat actor has claimed responsibility, and as of the disclosure the stolen data had not surfaced publicly.