DreamHost Data Breach: Intruder Stole FTP Logins for Two Months

In the DreamHost data breach, an intruder had access to the server behind the company's web File Manager at files.dreamhost.com from about August 2026 until 23 October 2026 and collected the FTP and SFTP passwords of everyone who logged in. Those logins can change hosted websites, so the exposure outlasts the fix.

What did DreamHost say was stolen?

DreamHost says an unauthorized third party broke into the server that runs its File Manager and took the FTP and SFTP usernames and passwords of customers who signed in there between approximately August 2026 and 23 October 2026, the day it discovered the intrusion.

The way in was “a vulnerability in that software,” in DreamHost’s words, with no bug class, CVE or CVSS score named. DreamHost calls the attack deliberate and says it has blocked the attacker and addressed the flaw. That stops new captures, not passwords the attacker already holds.

DreamHost believes the attacker may also have reached its webmail systems, exposing session information, including credentials, for a “limited number of users” it has not quantified. It found no evidence of access to control panel logins or to billing and payment details, which an external provider handles.

The company terminated active sessions, invalidated passwords for potentially affected users and offers one year of Equifax credit monitoring and identity theft protection. BleepingComputer says DreamHost did not answer repeated questions about how many accounts were hit.

Why do stolen FTP logins matter to a Cyprus business?

In our assessment, the bigger risk is the website itself. An FTP or SFTP password normally gives write access to a site’s files, no control panel needed. That is enough to swap an index page, add a redirect in .htaccess or insert script on a checkout page, which makes a hosting password a card-skimming and PCI DSS problem.

Our e-commerce penetration testing covers that checkout path. In our experience, agencies and affiliate partners often keep client sites on US shared hosting, so ask your suppliers directly whether they use DreamHost.

Webmail is the second problem. In our experience, intruders with mailbox access create forwarding rules that survive a password reset and keep copying reset emails and invoices to an outside address. The notice does not say any rule was created, but DreamHost advises reviewing them.

How should regulated firms log the DreamHost data breach?

For entities under NIS2, DORA or CySEC rules, record this as a third-party ICT incident in your ICT third-party or outsourcing register and assess it against your reporting thresholds. Our NIS2 compliance penetration testing treats hosting providers that hold live site credentials as in-scope supplier risk.

If a hosted site or mailbox held personal data, confirm in writing who is controller and who is processor, including any agency or reseller sub-processor. Where you are the controller, the 72-hour GDPR deadline for notifying the Commissioner for Personal Data Protection runs from when you become aware of the breach.

What should DreamHost customers check this week?

If anyone (staff, agency or freelancer) used files.dreamhost.com between August and 23 October 2026, treat those credentials as burned:

1. Rotate everywhere. Change the password anywhere it was reused: CMS admin, registrar, email, client panels.
2. Check file integrity. Diff web roots against version control or a pre-August backup, looking for modified .php, .js and .htaccess files and unexplained plugin or theme changes.
3. Audit every mailbox. Delete forwarding addresses, filters and auto-replies created since August that the owner did not set up.
4. Reduce password-based access. Switch deployments to SFTP key authentication and stop using a browser file manager for routine updates.
5. Warn staff. Expect phishing with fake reset links and fake Equifax enrollment pages.

In our experience, compromise after a hosting credential leak is rarely a defaced homepage. It is more often a one-line include in a theme file or a mail rule forwarding to an outside address.

For CMS sites, our WordPress and CMS penetration testing includes this core, plugin and theme review.

Is there a CVE for the DreamHost File Manager flaw?

No. DreamHost has published no CVE, CVSS score, affected version or patch version. It has named no threat actor and given no count of affected accounts or webmail users, and no date for notification letters.

It has also not confirmed whether resets covered all FTP/SFTP users or only File Manager users, or whether reseller sub-accounts and non-US customers are included. Until it answers, assume the worst for any account used in the File Manager during the window.

FAQ

Who is affected by the DreamHost File Manager breach?

Anyone who logged into files.dreamhost.com between approximately August 2026 and 23 October 2026 had their FTP/SFTP username and password exposed. A smaller, undefined group of webmail users may also have had session information exposed.

Were DreamHost control panel or payment details exposed?

DreamHost says it found no evidence of access to either. An external provider handles billing and payment data.

Should Cyprus firms worry if they only host a brochure site there?

Yes. Altered files can serve malware, redirects or phishing under your brand, and the same password may open email or CMS accounts elsewhere.

Does one year of Equifax monitoring cover a compromised website?

No. Credit monitoring watches a person's credit file, not a backdoor, skimmer or mail forwarding rule.

If your sites or a partner’s run on shared hosting and you are not sure what those FTP logins could reach, a focused web application penetration test will show you before someone else does.