DreamHost Confirms Data Breach Exposing FTP and Webmail Credentials
Unauthorized access to File Manager platform compromised customer login details over a two-month period
Key Takeaways
- DreamHost confirmed a data breach affecting its File Manager platform.
- Attackers accessed the system for approximately two months, stealing FTP/SFTP credentials and webmail session data.
- The breach was disclosed on November 4, 2026.
- Users are advised to rotate all related passwords and monitor accounts for unauthorized activity.
- DreamHost has likely applied patches to the File Manager platform, but technical details remain limited.
Quick answers
- What happened?
- DreamHost has confirmed a data breach in which attackers gained unauthorized access to the company's File Manager platform for approximately two months. During this time, customers' FTP and SFTP usernames and passwords were stolen, and webmail sessions were exposed. The breach was disclosed on November 4, 2026.
- Which products are affected?
- File Manager platform
- What should defenders do?
- DreamHost has implemented fixes to the File Manager platform. Affected users should immediately rotate their FTP/SFTP and webmail passwords, enable two-factor authentication where available, and monitor accounts for suspicious activity. It is recommended to review account logs and update any automated scripts or tools using saved credentials.
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords, as well as exposure of webmail sessions. According to the company, the unauthorized access occurred over an extended period, affecting users who rely on File Manager for site management and email services. The firm has advised affected users to rotate all credentials, including FTP/SFTP and webmail passwords, and to monitor accounts for suspicious activity. DreamHost stated it has implemented fixes to the File Manager platform, though specific technical details regarding the initial attack vector or the exact number of impacted users have not been fully disclosed. The breach was first reported by BleepingComputer and later confirmed by DreamHost in an advisory published on 2026-11-04.
Security Details
Unauthorized access to DreamHost's File Manager platform resulted in the theft of FTP/SFTP credentials and exposure of webmail sessions. The attackers maintained access for approximately two months before the breach was discovered and disclosed. Specific vulnerability details, exploitation methods, and the full scope of affected users remain under investigation.
Affected products
File Manager platform
Mitigation
DreamHost has implemented fixes to the File Manager platform. Affected users should immediately rotate their FTP/SFTP and webmail passwords, enable two-factor authentication where available, and monitor accounts for suspicious activity. It is recommended to review account logs and update any automated scripts or tools using saved credentials.
Sources
BleepingComputer
DreamHost confirms data breach exposed FTP logins and webmail sessions
Nov 4, 2026 · 19:05
Original link
Related Security News
Harvard University Alumni System Breach Exposes 851,000 Email Addresses
Hackers breached Harvard University's Alumni Affairs and Development systems in November 2025, stealing data linked to more than 850,000 unique email addresses. The breach was identified and reported via the Have I Been Pwned service in November 2026. The exposed information poses risks of phishing, credential stuffing, and targeted social engineering against alumni and university affiliates.
