DreamHost web File Manager breached, exposing FTP/SFTP credentials and some webmail logins

DreamHost says it discovered on October 23 that an unauthorized third party had accessed the server running its web-based File Manager at files.dreamhost.com, exploiting a vulnerability in the third-party software behind it to obtain FTP/SFTP usernames and passwords of users who had logged in before then ^[1]. The attacker also obtained login credentials for a limited number of webmail users and may have viewed mailbox contents in a small number of cases; DreamHost estimates well under about 10% of email and FTP/SFTP accounts were affected and found no evidence control panel logins or billing details were accessed ^[1]. Users who logged into File Manager between about August 2026 and October 23 should treat those credentials as compromised, change reused passwords elsewhere, and check website files and webmail forwarding rules for unauthorized changes ^[1].

Industries mainly affected: Technology

com, exploiting a vulnerability in the third-party software behind it to obtain FTP/SFTP usernames and passwords of users who had logged in before then ^[1]