Web host DreamHost has confirmed that hackers were inside its web based File Manager from August until October 23, 2026, stealing customer credentials as people logged in. The company disclosed the breach in a notice filed with California’s attorney general and in a security update on October 29, after an outage lasting several days during which it reset some customer passwords.
According to the notice, an unauthorized party exploited an unspecified vulnerability in the third party software behind the File Manager at files.dreamhost.com. The attacker captured FTP and SFTP usernames and passwords for users who logged in during the window, reached certain webmail systems and obtained login credentials for a limited number of webmail users, and in a small number of cases may have viewed mailbox contents. TechCrunch reported that the attackers also obtained session tokens, which keep users logged in after entering a password.
DreamHost told TechCrunch the affected share was well under 10 percent of its hosted accounts, against roughly 400,000 paying customers, but would not give an exact figure. It declined to say why the attack was not detected until October 23, citing its ongoing investigation. The company said it found no evidence that control panel logins or billing details were accessed, and that it does not store full card numbers.
DreamHost said it blocked the attacker, fixed the vulnerability, invalidated exposed passwords and ended active sessions, and is offering affected customers a year of credit monitoring and identity theft protection through Equifax.