DreamHost breach exposed FTP logins and some webmail sessions
Customers who used its File Manager should rotate passwords and check their sites for unauthorised changes, since the intruder had access for about two months.
DreamHost has disclosed a data breach in which an intruder exploited an unpatched weakness in its web-based File Manager and, over roughly two months from August 2026 until the company found it on October 23, 2026, collected FTP and SFTP usernames and passwords from people who used the tool. Webmail systems may also have been reached, exposing session information and login credentials for a small number of users. DreamHost says it has closed the access route, ended active sessions and invalidated passwords for affected accounts, and found no evidence that control panel logins or billing details were taken. A spokesperson put the share of affected customers at well under 10 percent of the company's roughly 400,000 paying customers, without giving an exact count. Recipients are advised to scan their site files for unauthorised changes, check webmail forwarding rules, and rotate passwords wherever the same credentials were reused, while DreamHost offers a year of credit monitoring through Equifax.
Why it matters
The breach reached the credentials that let customers reach their own websites, so it matters most for anyone who reused a password elsewhere. DreamHost says control panel logins and billing details were not taken, which narrows the exposure to file transfer and some webmail accounts. Affected users now face the task of verifying their site files and mail forwarding rules, while the company's offer of a year of credit monitoring through Equifax covers the risk of identity misuse.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.