DreamHost File Manager Breach: Reset FTP and Webmail Passwords

On the afternoon of Friday, Oct. 23, 2026, DreamHost found that an unauthorized third party had gotten into the server that runs its web-based File Manager at files.dreamhost.com, after exploiting a vulnerability in that third-party File Manager software. It was not a brief probe. By the time the company published its "October Security Incident" post on Oct. 29, customers were already sorting through password-reset emails while File Manager stayed offline for several days, and the open question was what had walked out the door.

The window was long. The attacker was able to access the FTP and SFTP usernames and passwords of people who logged into File Manager between about August 2026 and Oct. 23. The same intrusion reached certain webmail systems, where login credentials for a limited number of webmail users were taken, and DreamHost reset those passwords and ended those sessions the same day it found the break-in. In a small number of cases, the company believes the attacker may have used those credentials to view mailbox contents. Those customers are being contacted one by one.

This was a deliberate attack. The investigation is still open. DreamHost reports no evidence that control panel logins or billing and payment details were reached, and the company does not store full card numbers because payments go through a third-party processor. The hit covers a fraction of email and FTP/SFTP accounts, well under about 10 percent. DreamHost says it has about 400,000 paying customers. The "under 10 percent" figure applies to email and FTP accounts rather than the full customer roster.

Websites and email stayed up through the response. Inboxes still receive mail. The File Manager itself has since been rebuilt with extra security and monitoring and brought back online, and files remain in their FTP and SFTP accounts. DreamHost rotated internal credentials, brought in outside forensics, and is notifying regulators. Formal notices are coming. Customers who get a letter are offered a year of Equifax credit monitoring and identity theft protection, and the same letter points people toward setting a fraud alert or a security freeze if they want that extra step.

A California attorney general breach notice puts the start of the attack in August and notes that hackers obtained session tokens along the way, while the File Manager vulnerability itself has not been named in public. A company spokesperson declined to explain why the activity was not caught sooner. Separately, the incident is unrelated to the recent PHP server vulnerabilities that made headlines elsewhere; DreamHost patched PHP quickly, and its web application firewall blocked intrusion attempts tied to those flaws.

Illustration: Tech Cheat Codes

Who this hits

You may be affected if you, or someone with FTP or SFTP access on your account, logged into File Manager anytime from August through Oct. 23. Email users who were signed out and whose old password stopped working on or after Oct. 23 may also be affected, because DreamHost reset those passwords on the day it found the break-in. If a previously working password still works and you have not changed it, DreamHost says its investigation to date indicates it was not exposed. Change it anyway.

Small-business site owners should treat FTP and SFTP the same way they treat the keys to the office, because those logins rewrite site files and webmail credentials open forwarding rules and filters that quietly send copies of new mail somewhere else. Check the files. Even if your site looked fine the whole time File Manager was dark, take a few minutes to actually inspect what is sitting on the server rather than trusting the homepage alone.

What to do now

Only the account holder can reset passwords, and only from the DreamHost control panel at an address you type yourself. Open https://panel.dreamhost.com/ in your browser. Do not click a sign-in link from an email about this incident. DreamHost does not email asking for your password, and its incident emails do not ask you to sign in through a link.

1. Sign in at panel.dreamhost.com by typing the address. Open the password tools for mail users and for website users (DreamHost's knowledge base covers both). Reset every FTP and SFTP password tied to your account, then every email password you still use. Give the change up to 15 minutes to take effect.

2. Update every mail app and FTP program that still has the old password saved. A phone mail app or FileZilla will keep failing, or keep retrying the old secret, until you replace it.

3. Look over your website files for anything you do not recognize, including new PHP scripts, odd folders, changed index pages, or plugins you did not install, and compare what you see against a backup if you have one. If something looks wrong, take the site offline or switch to a known-good copy before you dig further, then contact DreamHost support from the panel at https://panel.dreamhost.com/support/.

4. Open webmail and check forwarding rules and filters. Delete any forward or filter you did not set. Attackers who briefly held a mailbox password can leave a quiet forward behind.

5. Pick strong, unique passwords for the control panel and for every FTP and email login you still need. Reusing the same string across hosting and your personal inbox is how one stolen login becomes a much bigger mess. If you do not use a password manager yet, our beginner overview is here: which password manager a beginner should use.

6. Watch for phishing that rides this headline. A message that pushes a "secure reset" link or a phone number is a separate attack. Stay inside the panel you typed yourself.

After the resets, keep an eye on the mailbox for a few days. Formal notices are still going out, and the customers DreamHost believes had mailbox contents viewed are being contacted directly. If you run a shop or a client site on DreamHost, tell whoever else has FTP access that their old password may no longer work and that they need the new one from you, not from an email. Support for account-specific questions sits behind the same panel login at https://panel.dreamhost.com/support/.

The File Manager is back online with the rebuilt stack and extra monitoring in place.

Want the next fix in plain English? Follow Tech Cheat Codes on Facebook. Tap this link, then tap Follow: Follow Tech Cheat Codes on Facebook

References

• Source: October Security Incident — DreamHost
• Source: Hackers stole DreamHost customer files and inboxes during months-long attack — TechCrunch (Zack Whittaker, Nov 4, 2026)
• Source: DreamHost confirms data breach exposed FTP logins and webmail sessions — BleepingComputer (Bill Toulas, Nov 4, 2026)