DreamHost says an unauthorized party broke into the server behind its browser-based File Manager and stayed there for about two months before anyone noticed. While inside, the intruder collected FTP and SFTP login credentials and got into some of the company's webmail systems. In a small number of cases, DreamHost says, the attacker may have read the contents of customer mailboxes.

The company disclosed the incident on Oct. 29, 2026. The case has since appeared on the California Attorney General's data breach list, and press reports based on that filing added a detail DreamHost's own post did not include: the attacker was also able to obtain session tokens.

What happened, by DreamHost's account

DreamHost says it found the intrusion on the afternoon of Friday, Oct. 23. Its post describes an unauthorized third party that had accessed the server running the web File Manager at files.dreamhost.com, the tool customers use to upload, edit and delete site files from a browser instead of an FTP client.

According to the company, the attacker got in by exploiting a vulnerability in third-party software running on that server. It does not say which software or which flaw. From that position the intruder could see the FTP/SFTP usernames and passwords of anyone who logged into File Manager before the breach was detected. The attacker also reached "certain webmail systems" and collected credentials for what DreamHost calls a limited number of webmail users. The company says it is contacting individually the small group of customers whose mailbox contents may have been viewed.

DreamHost's response, in its own words: it took the File Manager servers offline, fixed the vulnerability, reset the affected email and FTP/SFTP passwords, and ended active sessions. TechCrunch reported that the resulting outage lasted several days.

The company says it found no evidence that control panel logins or billing details were accessed, and notes that it does not store full payment card numbers.

How long the attacker was inside

The timeline is the most uncomfortable part. DreamHost tells customers who logged into File Manager between "approximately August 2026" and Oct. 23 to treat their FTP/SFTP credentials as compromised. The California AG listing for DreamHost, LLC gives a breach date of Aug. 15, 2026, and a reported date of Nov. 2, 2026. ZeroDayFeed read the list entry but did not open the notice document attached to it.

That leaves a window of about ten weeks in which a credential-harvesting foothold went unnoticed on a public-facing login service. TechCrunch reported that a DreamHost spokesperson declined to say why the activity went undetected for so long.

Session tokens and why they matter

DreamHost's public post talks about credentials. According to TechCrunch, the company's California AG notice goes further and says the attack let the hackers obtain session tokens. A Dataconomy summary of the same filing repeats this. We have not reviewed the notice ourselves, so this detail comes from the filing as press reports describe it, not from DreamHost's announcement.

The difference is real. A session token is the value a website hands your browser after you log in, so you don't have to type your password on every click. Anyone holding a valid token can act as you until it expires or is revoked, with no password needed. That explains why DreamHost's statement that it "ended sessions" matters as much as the password resets: changing a password does nothing about a token that is still live.

How many customers were hit

DreamHost hasn't given an exact number. TechCrunch reported that a spokesperson put affected customers at "well under 10%" of roughly 400,000 paying customers. On the roughly 400,000 customers figure, that puts a ceiling somewhere below 40,000 customers, but the real figure could be much lower. DreamHost's own post similarly says the incident affected "well under approximately 10%" of email and FTP/SFTP accounts. The count also depends on how many customers happened to use the browser File Manager during the window, which DreamHost has not said.

The spokesperson also told TechCrunch the vulnerability is unrelated to the recent PHP vulnerabilities, but did not name the flaw that was used. Until DreamHost or the software's maintainer publishes something, other hosts and admins running similar browser file-management tools have nothing to check their own systems against.

What It Means for Defenders

Who is affected. DreamHost customers who logged into the web File Manager at files.dreamhost.com between about August 2026 and Oct. 23, 2026, should assume their FTP/SFTP credentials were taken. A smaller group of DreamHost webmail users had their credentials exposed. Those whose mailboxes may have been read are supposed to get a direct message from DreamHost. If you only ever used a desktop FTP or SFTP client and never the browser File Manager, DreamHost's description suggests your file-transfer credentials were not part of this exposure. You should still make the checks below.

Passwords. DreamHost says it has already reset the affected email and FTP/SFTP passwords and ended sessions. Only the account holder can set a new password, and that is done in the DreamHost control panel. Because the old passwords are now in someone else's hands, change them anywhere else you used them: other hosting accounts, CMS admin logins, database users, and personal accounts.

Phishing. Expect fake "DreamHost security" emails timed to this news. DreamHost says its emails will never ask for your password. Treat any message that asks you to "confirm" or "re-enter" credentials as hostile, and go to the control panel directly instead of clicking links.

Site files. Anyone holding working FTP/SFTP credentials for two months could have changed your site, not just read it. DreamHost recommends reviewing site files. In practice, compare your web root against a known-good backup or your version-control copy. Look for files you don't recognize, recently changed PHP or JavaScript, new admin users in your CMS, and unexpected redirects or injected scripts. If you can't vouch for the current state of the site, restoring from a clean backup made before August is the safer choice.

Webmail. DreamHost specifically tells webmail users to review forwarding rules and filters. A common trick after a mailbox takeover is to add a quiet rule that forwards copies of incoming mail, or mail matching words like "invoice" or "password", to an outside address. Such a rule keeps working after the password changes. Delete any rule you didn't create. Then check whether any password-reset emails for other services passed through that inbox during the window, and rotate those accounts too.

Downstream credentials. Site files often contain secrets: database passwords in configuration files, API keys for payment or email services, cloud storage keys. If an attacker could read your web root, assume those were read as well, and rotate them at the provider that issued them.

Compliance. Small businesses and contractors that host client data or controlled information on shared hosting should decide whether this incident triggers their own notification or reporting duties. For organizations working through CMMC, a third-party hosting compromise like this belongs in your incident records and supplier-risk assessment even if no controlled information was involved.

The bigger lesson. A browser front end for file access is a high-value target: one login page that collects the keys to many customer sites. If your host offers one and you don't need it, using SFTP with key-based authentication instead shrinks the number of places your credentials ever pass through.

What we still don't know

DreamHost hasn't named the vulnerable third-party software, given an exact count of affected accounts, explained how the activity stayed hidden from August to late October, or said who was behind it. No group has publicly claimed the attack in any of the sources reviewed here, and DreamHost has not attributed it to anyone. We will update this story if the company or the software's maintainer releases details of the flaw.

Sources