DreamHost has now confirmed what was behind the forced password resets we covered on October 26. According to BleepingComputer, which quotes the web host’s data breach notification, an unauthorized third party exploited a vulnerability in the software on the server that runs DreamHost’s web-based File Manager (files.dreamhost.com). The notification says the attacker could see the FTP/SFTP usernames and passwords of people who logged into that File Manager between roughly August 2026 and October 23, 2026, the day DreamHost discovered the problem. It adds that the intruder may also have reached webmail systems, exposing session information, including credentials, for a limited number of users.
DreamHost calls the attack deliberate and says it has blocked the attacker’s access, fixed the vulnerability, ended active sessions for potentially affected users and invalidated their passwords. It says it found no evidence that the attacker accessed control panel login information or customer billing and payment details, which an outside provider handles. BleepingComputer asked DreamHost several times how many accounts were affected and had no reply, so the scale is not known. The notification letter, filed with the California Attorney General’s office, is linked from BleepingComputer’s article; we could not read the PDF, so everything here is attributed to BleepingComputer’s report of it.
How to check if you’re affected
Affected products are DreamHost FTP/SFTP logins used through the web File Manager since about August 2026, and a limited number of DreamHost webmail accounts. If you received a notification letter, you were in scope. BleepingComputer reports that recipients are advised to:
- Check your website files for unauthorized changes, since a stolen FTP/SFTP login could be used to modify them.
- Review webmail forwarding rules and filters for anything you did not create.
- Change the password on any other account where you used the same credentials.
DreamHost is offering affected individuals one year of credit monitoring and identity theft protection through Equifax, and letter recipients are urged to consider a fraud alert or a security freeze on their credit report. If you have not yet set a new DreamHost password after the October resets, our earlier post lists the steps DreamHost gave at the time.