DreamHost: File Manager attacker took FTP passwords and webmail logins

The web host DreamHost has disclosed a breach of its browser-based File Manager, the tool customers use to edit website files without an FTP client. According to DreamHost, the attacker collected FTP and SFTP passwords, and some webmail logins, from about August until it was spotted on 23 October.

What happened

DreamHost says it discovered on the afternoon of Friday 23 October 2026 that an unauthorised third party had accessed the server running the File Manager at files.dreamhost.com. The File Manager is built on third-party software, and the attacker exploited a vulnerability in it.

DreamHost says people who logged in to the File Manager between about August 2026 and 23 October 2026 may be affected.

What was taken

• FTP and SFTP usernames and passwords of users who logged in to the File Manager during that window.
• Webmail logins. The attacker was also able to reach certain webmail systems and get login credentials for a limited number of webmail users. In a small number of cases DreamHost believes mailbox contents may have been viewed.

DreamHost says that well under 10% of email and FTP/SFTP accounts were affected, and that it found no evidence the attacker reached control panel logins or billing details. Websites and email kept working throughout. DreamHost also says the incident was not related to its recent PHP server updates.

What DreamHost has done

• Took the File Manager servers offline, fixed the vulnerability and kept the affected server for forensic investigation
• Reset the passwords of affected email and FTP/SFTP users and ended their sessions
• Rebuilt the File Manager with extra security and monitoring
• Rotated internal credentials that might have been exposed, and started reviewing its other customer-facing tools for similar flaws
• Brought in outside security and forensics experts and notified regulators

What to do if you host with DreamHost

1. Set new passwords for affected mail, FTP and SFTP users from the control panel at panel.dreamhost.com. Only the account holder can do this, and a change can take up to 15 minutes to take effect.
2. Treat old FTP passwords as stolen, and change any other account where the same or a similar password was used.
3. Update saved passwords in your email, FTP and SFTP apps.
4. Look for changes to your website files that you didn’t make: new PHP files, edited .htaccess files, or scripts added to your pages.
5. Check your webmail forwarding rules and filters. A quiet forwarding rule is a classic way to keep reading someone’s mail after a password change.
6. Watch out for phishing. DreamHost says it will never email you asking for your password, and its incident emails won’t ask you to sign in through a link.

Spotting a tampered website from the outside

Attackers with FTP access often add a hidden redirect that sends some visitors, often only mobile visitors or people arriving from search engines, to spam or scam sites. Two quick checks:

• Run your homepage through our Redirect Checker. A normal site redirects at most once or twice (for example from http:// to https://www.). A hop to a domain you don’t own is a red flag.
• Run a Website Health Report to see the status code, title and security headers your site returns right now, and compare them with what you expect.

Neither replaces a proper look through your files, but both take seconds.

The bigger picture

FTP passwords are often years old, shared between people and saved in several apps, which makes them easy to forget about after a breach. If your host offers SSH keys or SFTP with key-based logins, now is a good moment to switch, and to delete FTP accounts nobody uses any more.

Sources

• DreamHost: October security incident (opens in a new tab)