DreamHost has reported the theft of webmail and FTP passwords belonging to customers following a targeted attack on its hosting infrastructure.
On 23 October, the provider announced via its status page that it was investigating an incident and had begun resetting mail passwords for several customers. Shortly afterward, it confirmed that FTP and SFTP account passwords had also been reset.
In a subsequent update, DreamHost stated that the incident was a deliberate attack aimed at its File Manager tool. This browser-based application, built on third-party software, allows customers to edit website files directly. Attackers exploited a vulnerability in the tool to obtain usernames and passwords from customers who logged in via FTP or SFTP.
The compromise took place between August and 23 October 2026, according to a data breach notification submitted to the Attorney General of California. The attackers also gained access to certain webmail systems and stole credentials from a limited number of webmail users. The exact number of affected individuals has not been disclosed.
Affected customers had their passwords reset and active webmail sessions terminated on the same day. In a small number of cases, the stolen credentials were used to view mailbox contents. DreamHost says it will notify these customers individually.
Overall, less than 10 percent of all mail and FTP/SFTP accounts hosted by the provider were impacted. The company has committed to implementing additional security measures to prevent recurrence of similar incidents.
