DreamHost confirmed that an unauthorized third party accessed its web-based File Manager at files.dreamhost.com and stole FTP/SFTP usernames and passwords between approximately August 2026 and October 23 2026, the date the breach was discovered. The attackers exploited a vulnerability in the File Manager software, and the intrusion may also have exposed webmail session information for a limited number of users. DreamHost said it found no evidence that control-panel logins or customer billing/payment details were accessed. The company has blocked the attackers, addressed the exploited vulnerability, stopped active sessions for potentially affected users and invalidated passwords. DreamHost is offering one year of credit monitoring and identity-theft protection through Equifax, and advises recipients to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on any other accounts where the same credentials may have been used. 1