What happened. DreamHost says an unauthorized party exploited a vulnerability in the software behind its web-based File Manager at files.dreamhost.com. Access ran from roughly August 2026 to Oct 23, 2026, the day DreamHost found it. It has blocked the access, fixed the flaw and earlier told users to reset email and FTP/SFTP passwords.
What was taken. FTP/SFTP usernames and passwords for people who logged into the File Manager in that window, plus webmail session information, including credentials, for a limited number of users. DreamHost says it found no sign the attacker reached control panel logins or billing and payment data. How many customers: Undisclosed.
Why this matters to an enterprise. FTP credentials let an attacker change the files on a website, which is the classic way to plant a skimmer or a fake login page on a marketing or customer site. If any team, agency or contractor hosts on DreamHost, rotate those FTP/SFTP and email passwords now and check site files for changes made since August.