This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered. "We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," reads the notification.
"The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between about August 2026 and October 23, 2026." In addition, DreamHost says the intruder may have also accessed webmail systems, exposing session information, including credentials, for a limited number of users. The firm said the attack appears deliberate, and its staff has been working nonstop to contain it fully. At this time, DreamHost said it found no evidence that the attacker accessed control panel login information or customer billing/payment details, which an external provider handles.
