DreamHost Discloses Breach Exposing FTP Credentials

The hosting company says an unauthorized party accessed its File Manager service, exposing customer login credentials and some webmail session data.

Updated on Nov. 6, 2026 in Cybersecurity

Flat-color editorial illustration of identical dark server drive modules, one drive slid partly out to show a small coral connector. — DreamHost disclosed that an unauthorized party exploited a flaw in its File Manager, potentially exposing customers' FTP and SFTP usernames and passwords. AI Illustration. Upload story photo >

Live Poll

Do you trust online hosting companies to keep your account data secure?

DreamHost has disclosed a security breach in which an unauthorized party accessed its web-based File Manager, potentially exposing FTP and SFTP usernames and passwords. The intrusion began in August 2026 and was discovered on October 23.

Why it matters

Exposed FTP and SFTP credentials can allow access to files hosted by customers, making affected users potential targets for further compromise. The company has not disclosed how many accounts were affected, leaving users unable to fully gauge their individual exposure.

DreamHost is offering one year of credit monitoring and identity theft protection through Equifax to affected customers. The company has not said how many accounts were involved, and it has not stated whether any stolen credentials have been used.

The players

DreamHost

DreamHost is a long-running web hosting and domain registration company that provides shared hosting, cloud services and domain services to individuals and businesses.

The details

An unauthorized party accessed DreamHost's File Manager after exploiting a vulnerability in the software running files.dreamhost.com. DreamHost cut off the attacker's access, fixed the flaw, terminated active sessions of potentially affected users, and invalidated their passwords, and it reported finding no evidence of access to control panel credentials or billing information.

August 2026: Intrusion into DreamHost systems began.
October 23, 2026: DreamHost discovered the breach.

Legacy Systems

Hosting providers that expose customer FTP and SFTP credentials typically respond by invalidating passwords and terminating sessions, as DreamHost has done here. DreamHost's disclosure follows that established pattern of incident response for file-access credential exposure.

Customers who used FTP or SFTP through DreamHost should change their passwords and review any files stored on their accounts. Those who received the Equifax credit monitoring offer can use it to watch for signs of identity misuse.

The takeaway

Anyone with hosted files should treat FTP and SFTP passwords as sensitive and rotate them promptly after any provider notice. Enabling key-based authentication where available reduces the risk tied to exposed passwords.