DreamHost has confirmed that a security breach prompted the October 23 shutdown of its File Manager and the password resets that followed. In an announcement on October 29, DreamHost reports that an unauthorized third party exploited a vulnerability in the third-party software behind its browser-based File Manager. The attacker was able to access the FTP/SFTP usernames and passwords of users who logged into the tool before the activity was detected on October 23.

The attacker also reached certain webmail systems and obtained the login credentials of a limited number of webmail users. In a small number of cases, DreamHost believes the attacker may have viewed mailbox contents, and it is contacting those customers individually. According to DreamHost’s current analysis, the incident affected a fraction of its hosted email and FTP/SFTP accounts, well under 10%.

DreamHost Urges Affected Owners to Reset Every Email and FTP Password

Key facts

  • Discovery: DreamHost found the unauthorized access on the afternoon of Friday, October 23, and took the File Manager servers offline.
  • No evidence of access: according to DreamHost, its investigation has found no indication that control panel logins or customer billing details were accessed.
  • Notifications: the company is notifying regulators and plans formal notices to affected users in line with local law.
  • Exposure window: DreamHost advises users who signed in to the File Manager from about August to October 23 to treat those FTP/SFTP credentials as compromised.

The Vulnerability and Its Scope

The File Manager at files.dreamhost.com is a browser-based tool that customers use to work on their website files. DreamHost describes it as built on third-party software, without naming the software, and calls the incident a deliberate attack.

The company also notes that the breach was not related to the recent PHP security updates.

DreamHost found no evidence that the attacker accessed control panel logins or customer billing details. It does not store full payment card numbers, which are handled by a third-party payment processor.

Japan’s GMO Refuses Ransom After VPS Breach and Offers $1 Million Bounty

Who Needs to Act

As we reported on October 26, DreamHost initially expired the passwords of some email and FTP/SFTP users and emailed account owners to set new ones. According to the announcement, DreamHost’s ongoing investigation suggests that not everyone who received that email was affected, and that fewer customers are known to be affected than originally suspected.

According to DreamHost, two situations may mean that a user is affected:

  • the user, or an FTP/SFTP user on the account, logged into the File Manager between approximately August and October 23, 2026. The company advises treating those usernames and passwords as compromised and changing any other account that uses the same or a similar password.
  • an email user was signed out and the old password stopped working on or after October 23. That was the host’s own precautionary reset.

Neither situation necessarily means that a user was affected, DreamHost adds. If a previously working password still works and has not been changed, its investigation to date indicates that it was not exposed, although the company encourages changing it anyway.

Affected mail, FTP and SFTP accounts stay active, but their users cannot sign in until the account owner sets a new password in the control panel. DreamHost also recommends checking website files for changes the owner does not recognize and reviewing webmail forwarding rules and filters. Customers who store information about their own clients may wish to consult their legal advisors about their own obligations, the company adds.

Websites and email remained available throughout the incident, according to DreamHost, and mailboxes kept receiving mail even while their users could not sign in. The company also reminds customers that it never asks for passwords by email and that its incident emails never ask users to sign in through a link.

What DreamHost Has Changed

The compromised File Manager server has been taken out of service and preserved for forensic investigation. DreamHost rebuilt the File Manager with additional security precautions and enhanced monitoring before bringing it back on October 26. On October 27, it marked the incident resolved on its status page. It has rotated internal credentials that may have been exposed, addressed the vulnerability and is reviewing its other customer-facing tools for similar weaknesses. Outside security and forensics experts are working with its internal teams, and the investigation is ongoing.