DreamHost warns attackers accessed File Manager and stole customer FTP/SFTP credentials
DreamHost is warning customers of a data breach in which attackers had access to its File Manager platform for about two months.
Written by a model from the sources below. Verify against them.
- Vendor
- DreamHost
- Product
- File Manager
- Status
- Confirmed
- Disclosed
- Data taken
- Tokens and keys
- BleepingComputer on Bluesky: “The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged i…”
- Exploited vulnerability
Summary
According to DreamHost's warning, as reported by BleepingComputer, the attackers stole customers' FTP and SFTP usernames and passwords.
What to do
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keys (some users)Change your DreamHost FTP and SFTP passwords now
Switch SFTP access to SSH key-based authentication where supported
Review File Manager and FTP/SFTP logs for unfamiliar logins or file changes
Check websites and hosted files for unauthorized changes or uploads
Timeline
- Discovered
BleepingComputer on Bluesky: “In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.”
12 days - Made public by BleepingComputer on Bluesky
- Confirmed by DreamHost1 day
- First seen by cve.now
What was taken
| Taken | Per the source |
|---|---|
| Tokens and keys (some users) | Mastodon: “DreamHost just revealed a data breach that exposed FTP logins and webmail sessions for some users” |
Evidence 11
- PressBleepingComputer on Bluesky
“DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.”
- Social
- Social
- Social
- SocialMastodon
“DreamHost has confirmed a breach that exposed customer login details after hackers exploited its web-based File Manager.”
Show all 11 sourcesShow fewer sources
- Social
- SocialBluesky
“DreamHost has disclosed a security incident involving unauthorized access to customer credentials after attackers exploited a vulnerability in its File Manager…”
- SocialBluesky
“mSeven Software Investigates Suspicious Activity Affecting mSecure as DreamHost Confirms Credential Exposure Incident + Video”
- SocialMastodon
“DreamHost reports a data breach between August and October 2026 after attackers exploited a vulnerability in its web-based File Manager to steal FTP/SFTP credentials and hijack webmail sessions.”
- SocialBluesky
“DreamHost has confirmed that attackers gained access to its File Manager platform for about two months and exposed customers' FTP, SFTP and SSH use...”
- SocialBluesky
“DreamHost Data Breach Exposes File Manager Vulnerability”
Corrections
- Changed “Tokens and keys were exposed” to “Tokens and keys of some users were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the DreamHost breach
Was DreamHost breached?
Yes. DreamHost says so: “In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.” (BleepingComputer on Bluesky).
What data was exposed?
Tokens and keys (some users).
What should DreamHost customers do?
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Change your DreamHost FTP and SFTP passwords now. Switch SFTP access to SSH key-based authentication where supported. Review File Manager and FTP/SFTP logs for unfamiliar logins or file changes. Check websites and hosted files for unauthorized changes or uploads.