Web hosting provider DreamHost has confirmed that hackers stole customer login credentials and potentially accessed emails and website files during a cyberattack that began in August 2026. The company discovered the intrusion on October 23, prompting several days of service disruptions and precautionary password resets for affected customers.
In an official security announcement published on October 29, DreamHost said attackers exploited a vulnerability in its web-based File Manager to access customer accounts. The company has since addressed the vulnerability, although its investigation into the incident remains ongoing.
Hackers Exploited File Manager Vulnerability
According to a data breach notification filed with California’s attorney general, the unauthorized access began around August 15, 2026, and continued until the company detected the intrusion on October 23.
The attackers exploited an unspecified vulnerability in third-party software powering DreamHost’s File Manager, which customers use to manage website files. The breach exposed FTP and SFTP usernames and passwords belonging to users who accessed the service during the affected period.
Hackers also accessed certain webmail systems, potentially obtaining session information and credentials that allow users to remain logged in without repeatedly entering passwords. DreamHost acknowledged that attackers may have viewed mailbox contents in a limited number of cases.
The company said its investigation had found no evidence that hackers accessed customer control panel credentials or billing information. DreamHost also clarified that the incident was unrelated to recently discovered vulnerabilities affecting PHP software.
Fewer Than 10% of Accounts Affected
DreamHost, which reports approximately 400,000 paying customers, said the incident affected well under 10% of its hosted email and FTP/SFTP accounts. However, the company declined to provide an exact number of affected customers.
A spokesperson also declined to explain why the intrusion remained undetected for several months, citing the ongoing investigation. DreamHost has not disclosed the specific software vulnerability exploited by the attackers.
Password Resets and Service Disruptions
After discovering the breach, DreamHost took its File Manager servers offline, terminated potentially compromised sessions, and reset affected email and FTP/SFTP passwords. The resulting disruptions continued for several days, with the company’s status page confirming that services were restored on October 27.
DreamHost said it rebuilt the affected File Manager service with additional security measures and monitoring capabilities. The company also engaged external cybersecurity and forensic specialists to investigate the intrusion.
Affected customers were advised to update their passwords, review website files for unauthorized changes, and inspect email forwarding rules and filters for suspicious activity. DreamHost is contacting customers whose mailbox contents may have been accessed and notifying relevant regulatory authorities.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.