# SZB-38f944c737: DreamHost warns attackers accessed File Manager and stole customer FTP/SFTP credentials

DreamHost is warning customers of a data breach in which attackers had access to its File Manager platform for about two months.

- Type: Breach
- Status: Confirmed
- Vendor: DreamHost
- Product: File Manager
- Disclosed: 2026-11-04 19:06 UTC
- Data taken: Tokens and keys
- Way in: Exploited vulnerability (BleepingComputer on Bluesky: “The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged i…”, [source](https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/))
- Sources: 11 distinct
- First seen by cve.now: 2026-11-05 03:20 UTC · Updated: 2026-11-05 22:35 UTC

Written by a model from the sources below. Verify against them.

## Summary

According to DreamHost's warning, as reported by BleepingComputer, the attackers stole customers' FTP and SFTP usernames and passwords.

## What to do

- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys (some users)
- Change your DreamHost FTP and SFTP passwords now
- Switch SFTP access to SSH key-based authentication where supported
- Review File Manager and FTP/SFTP logs for unfamiliar logins or file changes
- Check websites and hosted files for unauthorized changes or uploads

## Timeline

- 2026-10-23: Discovered. BleepingComputer on Bluesky: “In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.” ([source](https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/))
- 2026-11-04 19:06 UTC: Made public by BleepingComputer on Bluesky
- 2026-11-04 19:06 UTC: Confirmed by DreamHost
- 2026-11-05 03:20 UTC: First seen by cve.now

## What was taken

- Tokens and keys (some users): [Mastodon](https://mastodon.social/@Analyst207/117559804324207950): “DreamHost just revealed a data breach that exposed FTP logins and webmail sessions for some users”

## Evidence (11 sources)

- 2026-11-04 · Press · [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzj2di5hem2o): “DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.”
- 2026-11-04 · Social · [Mastodon](https://mastodon.social/@Analyst207/117559804324207950): “DreamHost just revealed a data breach that exposed FTP logins and webmail sessions for some users” (+2 more: [Mastodon](https://infosec.exchange/@cloud/117561898684162945), [Mastodon](https://mastodon.thenewoil.org/@thenewoil/117565607491044138))
- 2026-11-04 · Social · [Mastodon](https://social.raytec.co/@techbot/117559952498304831): “DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.” (+1 more: [Mastodon](https://infosec.exchange/@cloud/117559969435791003))
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/gmsiy3tvjf4gs): “DreamHost Confirms Data Breach – Hackers Stole Customer Credentials and Accessed Emails” (+1 more: [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzkek3d7uh2x))
- 2026-11-05 · Social · [Mastodon](https://social.raytec.co/@techbot/117561840074064378): “DreamHost has confirmed a breach that exposed customer login details after hackers exploited its web-based File Manager.”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzjz4geqyz23): “DreamHost: flaw in files.dreamhost.com exploited Aug–Oct 23 exposed customers' FTP/SFTP logins+passwords and some webmail sessions.” (+3 more: [Bluesky](https://bsky.app/profile/samilaiho.com/post/3mzkuqrfki22n), [Bluesky](https://bsky.app/profile/thenewoil.org/post/3mzlnta3lplr2), [Bluesky](https://bsky.app/profile/hacker.at.thenote.app/post/3mzlqztldw22r))
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzk2fbeiq52g): “DreamHost has disclosed a security incident involving unauthorized access to customer credentials after attackers exploited a vulnerability in its File Manager…”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzkhi6byf62g): “mSeven Software Investigates Suspicious Activity Affecting mSecure as DreamHost Confirms Credential Exposure Incident + Video”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@beyondmachines1/117563018888421031): “DreamHost reports a data breach between August and October 2026 after attackers exploited a vulnerability in its web-based File Manager to steal FTP/SFTP credentials and hijack webmail sessions.”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzkmpurjed2l): “DreamHost has confirmed that attackers gained access to its File Manager platform for about two months and exposed customers' FTP, SFTP and SSH use...”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/crustytldr.bsky.social/post/3mzl5a3pnrg2t): “DreamHost Data Breach Exposes File Manager Vulnerability”

## Corrections

- 2026-11-05: Changed “Tokens and keys were exposed” to “Tokens and keys of some users were exposed”.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-38f944c737&body=https%3A%2F%2Fcve.now%2FSZB-38f944c737%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the DreamHost breach

### Was DreamHost breached?

Yes. DreamHost says so: “In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered.” (BleepingComputer on Bluesky).

Source: https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/

### What data was exposed?

Tokens and keys (some users).

### What should DreamHost customers do?

Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Change your DreamHost FTP and SFTP passwords now. Switch SFTP access to SSH key-based authentication where supported. Review File Manager and FTP/SFTP logs for unfamiliar logins or file changes. Check websites and hosted files for unauthorized changes or uploads.

## Related

- Started as early warning SZB-38f944c737, first seen 2026-11-05 03:20 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-38f944c737
Site guide for agents: https://cve.now/llms.txt