DreamHost told California’s attorney general that hackers obtained customer session tokens and login credentials in an attack that began in August 2026. The web host didn’t catch the intrusion, which ran through third-party software behind its File Manager, until October 23.
The Essentials
- DreamHost says attackers exploited a vulnerability in the third-party software that runs File Manager, its browser tool at files.dreamhost.com.
- FTP and SFTP users who logged into File Manager between roughly August and the detection date should treat those logins as stolen.
- A DreamHost spokesperson put the affected share at “well under 10%” of roughly 400,000 paying customers, without giving an exact count.
- The company says it has found no evidence that attackers reached control panel logins or customer billing details.
Stolen session tokens let attackers act as customers
As first reported by TechCrunch, the breach notice says the attackers took session tokens. Those tokens keep a user signed in after entering a password, so whoever holds one can act as that user.
DreamHost’s own incident notice explains where the credentials came from. The attacker could see the FTP/SFTP usernames and passwords of anyone who logged into File Manager before the intrusion was caught. It also obtained webmail logins for a limited number of users and, in a small number of cases, may have viewed mailbox contents.
The breach first surfaced as a File Manager outage and a round of forced email and FTP password resets. DreamHost first called those resets a precaution. Its advice now is blunter: “Please treat those usernames and passwords as compromised.“
File Manager’s design made it an efficient target. Customers typed FTP credentials into one web front end, so a single compromised server could collect logins from every user who passed through it. DreamHost reset affected passwords and ended active sessions on the day it found the intrusion. The second step matters as much as the first, because a stolen token can outlive a password change.
🚨🇺🇸 DreamHost Confirms Data Breach, Hackers Stole Customer Credentials and Accessed Email Inboxes Web hosting provider DreamHost has confirmed that hackers gained unauthorized access to its systems during a months-long cyberattack, stealing customer credentials and potentially accessing private email communications. The intrusion began in August 2026 and remained undetected until October 23, when DreamHost discovered attackers had exploited a vulnerability in its web-based File Manager. The attackers obtained FTP/SFTP usernames and passwords, along with webmail credentials and session tokens. In some cases, the stolen credentials may have allowed hackers to access customer inboxes and read private emails. DreamHost | Security Incident • Attack period: August to October 23, 2026 • Affected accounts: Well under 10% • Exposed: FTP/SFTP credentials and webmail login information • Impact: Potential unauthorized access to customer email accounts • Vulnerability: Undisclosed File Manager security flaw • Investigation: Ongoing DreamHost says it has blocked the attackers, patched the vulnerability, and reset affected credentials. The company found no evidence that customer billing information or control panel credentials were compromised. The exact number of affected customers remains undisclosed.
— Dark Web Informer (@DarkWebInformer) November 4, 2026
DreamHost won’t say how the attack went unnoticed
A DreamHost spokesperson declined to explain why detection took so long, citing the ongoing investigation. The company hasn’t named the vulnerable software, published a CVE identifier or described the flaw. It did say the incident has no connection to recent PHP server updates, which it patched within hours of their release.
The damage estimate has shifted, too. DreamHost says its precautionary notices reached more customers than investigators now believe were affected, so a reset email doesn’t confirm exposure. It doesn’t store full payment card numbers either, since a third party processes payments.
Several gaps remain in the public record:
- Which third-party product powers File Manager, and do other hosts run the same vulnerable version?
- Why did monitoring miss an intruder for months?
- How many customers had mailbox contents viewed?
- Did the stolen session tokens open any system beyond File Manager and webmail?
Those no-evidence findings reflect the investigation so far, and the forensic work continues.
Account holders must reset passwords themselves
Only the DreamHost account holder can assign new passwords through the control panel, and changes take up to 15 minutes. These steps help reduce risk for anyone who used File Manager or webmail during the window:
- Update saved passwords in email, FTP and SFTP clients.
- Check website files for changes nobody on the account made.
- Review webmail forwarding rules and filters for entries you didn’t create.
- Replace any reused or similar passwords on other services.
Customers should also expect copycat messages, since breach notices make convenient phishing email bait. DreamHost says its incident emails never ask for passwords or send sign-in links, so users should type panel.dreamhost.com into the browser directly.
DreamHost says it rebuilt File Manager with extra monitoring and rotated internal credentials that may have been exposed. It’s also reviewing other customer-facing tools for similar weaknesses. The next step is formal breach notices to customers and regulators, which the company is still preparing. Those letters may be the first place DreamHost commits to a firm count of how many accounts the attacker actually reached.
