--- title: DreamHost confirms data breach exposed FTP logins and... description: DreamHost confirmed attackers accessed its web-based File Manager at files.dreamhost.com for about two months, stealing FTP/SFTP usernames and passwords. The... canonical: https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DreamHost confirms data breach exposed FTP logins and webmail sessions | daily.dev og:description: DreamHost confirmed attackers accessed its web-based File Manager at files.dreamhost.com for about two months, stealing FTP/SFTP usernames and passwords. The... og:url: https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk og:image: https://api.daily.dev/og/posts/ufPda6fvk.png og:image:alt: DreamHost confirms data breach exposed FTP logins and webmail sessions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DreamHost confirms data breach exposed FTP logins and webmail sessions **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary DreamHost confirmed attackers accessed its web-based File Manager at files.dreamhost.com for about two months, stealing FTP/SFTP usernames and passwords. The breach ran from roughly August 2026 to October 23, 2026, when it was discovered. Attackers exploited a software vulnerability and may have also accessed webmail systems, exposing session information and credentials for a limited number of users. DreamHost found no evidence that control panel logins or billing details were accessed, blocked the attackers, patched the vulnerability, and is offering one year of credit monitoring through Equifax. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What data was exposed in the DreamHost File Manager breach? The breach exposed FTP/SFTP usernames and passwords for users who logged into DreamHost's web-based File Manager at files.dreamhost.com between roughly August 2026 and October 23, 2026. Webmail session information, including credentials, may also have been exposed for a limited number of users. DreamHost found no evidence that control panel logins or billing details were accessed. _Keeping up with hosting provider breaches like this one is easier when tracking security news on daily.dev._ ### How long did the DreamHost File Manager breach go undetected? The breach lasted roughly two months, from around August 2026 until it was discovered on October 23, 2026. An unauthorized third party exploited a vulnerability in the File Manager software running at files.dreamhost.com to access FTP/SFTP credentials during that window. _Developers managing hosted infrastructure follow breach timelines like this on daily.dev._ ### What should I do if I received a DreamHost data breach notification? Check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts that reuse the exposed credentials. DreamHost also stopped active sessions and invalidated passwords for affected users, and is offering one year of free credit monitoring and identity theft protection through Equifax. _Anyone securing hosted accounts after a breach can stay on top of advisories like this via daily.dev._ ## Similar posts on daily.dev - [cPanel flaw exposes enterprises to hosting supply-chain risks](https://daily.dev/posts/cpanel-flaw-exposes-enterprises-to-hosting-supply-chain-risks-dd2mlbkvf) · CSO Online · 1 upvotes · 0 comments - [Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites](https://daily.dev/posts/hackers-are-mass-exploiting-a-gravity-smtp-flaw-to-steal-api-keys-from-100-000-wordpress-sites-hhj1prnxn) · The Next Web · 0 upvotes · 0 comments - [Data breach exposes up to 14.2 million email logins at six ISPs](https://daily.dev/posts/data-breach-exposes-up-to-14-2-million-email-logins-at-six-isps-seex7uzig) · BleepingComputer · 0 upvotes · 0 comments - [Have I Been Pwned: SoundCloud Data Breach](https://daily.dev/posts/have-i-been-pwned-soundcloud-data-breach-sddcswlvy) · Hacker News · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DreamHost confirms data breach exposed FTP logins and webmail sessions","url":"https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk"},"datePublished":"2026-11-04T19:17:06.416Z","dateModified":"2026-11-04T20:46:05.844Z","description":"DreamHost confirmed attackers accessed its web-based File Manager at files.dreamhost.com for about two months, stealing FTP/SFTP usernames and passwords. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ac57bc4983a037d3e5d08f1c44eb9fc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ac57bc4983a037d3e5d08f1c44eb9fc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"DreamHost confirms data breach exposed FTP logins and webmail sessions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions-ufpda6fvk#faq","mainEntity":[{"@type":"Question","name":"What data was exposed in the DreamHost File Manager breach?","acceptedAnswer":{"@type":"Answer","text":"The breach exposed FTP/SFTP usernames and passwords for users who logged into DreamHost's web-based File Manager at files.dreamhost.com between roughly August 2026 and October 23, 2026. Webmail session information, including credentials, may also have been exposed for a limited number of users. DreamHost found no evidence that control panel logins or billing details were accessed. Keeping up with hosting provider breaches like this one is easier when tracking security news on daily.dev."}},{"@type":"Question","name":"How long did the DreamHost File Manager breach go undetected?","acceptedAnswer":{"@type":"Answer","text":"The breach lasted roughly two months, from around August 2026 until it was discovered on October 23, 2026. An unauthorized third party exploited a vulnerability in the File Manager software running at files.dreamhost.com to access FTP/SFTP credentials during that window. Developers managing hosted infrastructure follow breach timelines like this on daily.dev."}},{"@type":"Question","name":"What should I do if I received a DreamHost data breach notification?","acceptedAnswer":{"@type":"Answer","text":"Check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts that reuse the exposed credentials. DreamHost also stopped active sessions and invalidated passwords for affected users, and is offering one year of free credit monitoring and identity theft protection through Equifax. Anyone securing hosted accounts after a breach can stay on top of advisories like this via daily.dev."}}]} ```