DreamHost discloses months-long File Manager intrusion that stole customer e-mails and credentials

DreamHost confirmed that hackers exploited a vulnerability in its web-based File Manager to steal customer e-mails and credentials, accessing the server at files.dreamhost.com from about August 2026 until the company discovered the intrusion on Friday, Oct. 23, 2026, after File Manager began acting abnormally.

The network counts some 400,000 paying customers. The company puts affected accounts at “well under 10%” of e-mail and FTP or SFTP accounts and has not given a more precise figure or an exact count of affected customers.

The intruder obtained FTP and SFTP login credentials for people who used File Manager from about August 2026 through Oct. 23, 2026. The flaw was in third-party software behind File Manager.

The company says the intruder may have reached webmail systems, exposing session details and credentials for a limited number of users. TechCrunch reports that intruders obtained session tokens, which keep users signed in after they enter passwords, and that a stolen token lets an intruder sign in as though they were that user.

The company believes the intruder may have read the contents of some mailboxes, though it describes this as a belief rather than a confirmed count. The company said it has no evidence that the intruder obtained customers’ payment and billing details, and it says the same of control panel login information. It says an external provider handles billing and payment details, and it does not store complete payment card numbers.

The company says it found the trouble on Friday, Oct. 23, 2026, when File Manager at files.dreamhost.com started behaving abnormally. The service quickly went offline, some webmail customers lost access, and the company began requiring password changes for certain e-mail and FTP/SFTP users as a precaution.

That weekend, DreamHost took File Manager offline and forced password resets for some users. The company created and deployed a fix for File Manager and brought files.dreamhost.com back online, and it said it watched to confirm the service was fully working again.

The company says it cut off the attackers’ access and fixed the vulnerability they exploited. DreamHost staff have been working around the clock to contain the incident fully.

It also filed a breach notice with California’s attorney general following the days-long service outage, and it published a fuller breach notice on Oct. 29, 2026. It told regulators that formal breach notices are coming and that outside experts are assisting with the investigation.

The company says there is no evidence in the public record that a customer site was altered. It also notes that regulators could require a full accounting of affected accounts.

A spokesperson for DreamHost declined to explain the detection delay, pointing to an ongoing investigation, and declined to name the vulnerability exploited. The company said the breach had nothing to do with recently discovered flaws in PHP web software. The break-in came on the heels of a days-long outage while DreamHost reset some customer passwords.

Customers who used File Manager from about August through Oct. 23, 2026 should treat those usernames and passwords as compromised, the company said. “Please treat those usernames and passwords as compromised.” Only an account owner can create new passwords for mail and FTP users, and the company cannot reach individual mailbox or FTP users directly, so account owners must pass the news on themselves. A password change can take as long as 15 minutes to take effect.

They should create a new, unique password for each mail, FTP and SFTP user, and they should change that password on every other service where they used the same one. They should refresh saved passwords in mail apps, FTP clients, backup tools and deployment scripts so automatic logins keep working, and they should allow time for the new passwords to propagate through systems. Reusing credentials across services widens the theft’s blast radius.

The company tells recipients to check their webmail forwarding rules and filters, to open each mailbox to delete forwarding rules and filters they did not set up themselves, and to inspect website files for changes they did not authorize, such as unfamiliar folders, strange scripts or changed page templates. Those rules can forward every incoming message, including password-reset links, to someone else.

DreamHost says it does not ask for passwords by e-mail and says its notices will not ask users to sign in through a link. Customers should type panel.dreamhost.com into a browser instead of clicking a link in an e-mail. The company is providing affected customers with a year of credit monitoring and identity-theft protection from Equifax.