DreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of everyone who logged in from about August to October 23, 2026, and may have exposed webmail session data, emails and files.
DreamHost has told customers in a breach notice filed with California's attorney general that an attacker exploited a vulnerability in the software behind its web-based File Manager at files.dreamhost.com and obtained the FTP/SFTP usernames and passwords of people who logged in to it between approximately August 2026 and October 23, 2026. The state listing gives August 15, 2026 as the breach date. The attacker also reached certain webmail systems, which "may have exposed the session information" of a limited number of webmail users, and the notice letter says email contents and files on FTP/SFTP servers may also have been accessed. DreamHost says it found no evidence of access to control panel logins or billing details, ended affected sessions, reset passwords and is offering a year of identity theft protection. It told TechCrunch the affected share is "well under 10%."
Why it matters
The attacker sat on a login page for about ten weeks, so the passwords were taken as users typed them. How well a host stores passwords does not matter when the collection point is the sign-in form itself. The webmail session data is the other half: a live session lets an attacker read mail without the password or a second factor, which is why DreamHost ended sessions rather than only resetting passwords. That is session hijacking, and a hosting mailbox is often the reset channel for everything else a site owner runs.
If you host with DreamHost, reset mail, FTP and SFTP passwords from the control panel, check every mailbox for forwarding rules and filters you did not create, review site files for changes, and change any reused password elsewhere, since reused credentials feed credential stuffing. Where you can, replace password FTP with SFTP keys. Chainalysis also reported live session tokens exposed this week.
Source: DreamHost, California Attorney General, TechCrunch
Related on Start with Identity
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- BlogSony's So-net says an intruder took 2.6 million member records and 54,401 email passwords
Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala rec
- BlogPassword manager mSecure tells users to change passwords and remove passkeys, without saying what happened
mSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwor
- CVEZammad session hijack zero-day that led to remote code execution
A session hijack flaw in Zammad 6.3.0 to 6.5.4 gave attackers code execution as the zammad user. It was exploited against DIVD before disclosure. CISA KEV on Oc
- TechniqueAttacker-in-the-middle phishing proxy
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful lo
- VendorAWS Secrets Manager
strong