DreamHost has confirmed that an attacker broke into the server behind its browser-based File Manager and accessed the FTP and SFTP logins of users who signed in between roughly August 2026 and October 23, 2026. The DreamHost FTP password leak is about your website files: those passwords may have been enough to change your site before DreamHost reset them.
Key takeaways
- An attacker exploited DreamHost's web File Manager at files.dreamhost.com; discovery came on October 23, 2026.
- FTP and SFTP logins of users who signed in there from about August 2026 were exposed, and some webmail session data may also have leaked.
- DreamHost published no CVE, no indicators and no account count, and says it found no evidence that panel logins or billing data were accessed.
- A password reset does not remove files planted with stolen logins, so audit site files from early August and restore only from backups older than that.
What did DreamHost say was taken from the File Manager?
DreamHost says an unauthorized third party exploited a vulnerability in the software at files.dreamhost.com. The letter names no CVE, version or flaw class. It says the attack appears deliberate, that DreamHost blocked the attacker, fixed the vulnerability, ended active sessions and invalidated passwords for users it considered at risk.
The letter follows an earlier notice to reset email and FTP/SFTP passwords. If you already reset, this letter explains what the reset did not cover. We walked through the first wave in our DreamHost password reset checks.
What we know about the scope so far
- File Manager users: credentials of users who logged into files.dreamhost.com between about August and October 23 were exposed.
- Webmail: the intruder may also have reached webmail systems, exposing session information, including credentials, for a limited number of users.
- Panel and billing: DreamHost found no evidence of access to control panel logins or to billing and payment data, which an external provider handles.
- Account count: not disclosed. BleepingComputer asked DreamHost several times and got no answer.
If you signed in during that window, treat your site files as possibly modified. Agencies that opened several client sites should assume each one was touched. If you cannot confirm use, ask DreamHost support whether your account was notified, and start the audit while you wait. DreamHost has published no attribution and no indicators of compromise.
Why a stolen FTP password outlasts the password reset
On most shared hosts, an FTP or SFTP login can edit files anywhere in a site’s document root. Whoever used those credentials during the window could have dropped a PHP webshell into uploads, appended a redirect to a theme file or edited .htaccess.
A reset locks the door but does not clean the house. Planted files can call home, recreate admin users or reinfect the site. File access alone is enough to take over a WordPress or Joomla install.
What should you check after the DreamHost FTP password leak?
Audit from early August, not just the days since the notice. DreamHost tells notified customers to check website files for unauthorized changes.
- Pull FTP/SFTP access logs from the panel where available and look for logins from unfamiliar IPs between August and October 23.
- List PHP files modified since early August in wp-content/uploads, theme and plugin folders, mu-plugins, and Joomla’s images and tmp directories. A PHP file in an uploads folder is almost always hostile.
- Look for short files named like cache or config helpers, and for code appended to plugin files after long blank lines.
- Compare core, theme and plugin files against the vendor’s original copies, or reinstall them from official sources. Attackers sometimes reset timestamps, so this is the only check that proves a file is clean.
- Check .htaccess and .user.ini for new rewrite or prepend rules.
- Review admin users. In WordPress, confirm that home and siteurl in wp_options still point to your domain.
- Load the site logged out on a phone using mobile data. Cloaked spam redirects often hide from admins.
- Set a new, unique FTP/SFTP password and change it everywhere you reused the old one.
If you need to roll back, use a backup taken before early August. A snapshot from inside the window may already contain the backdoor. On larger sites, SiteGuarding Antivirus speeds up the file comparison. If Google flags the site, follow our guide to remove a Google hacked-site warning.
What about webmail forwards and credit monitoring?
If you got the letter and use DreamHost webmail, check every forwarding address, filter and inbox rule. A stolen session can open a mailbox without the password, and a rule added then keeps leaking mail after the password changes.
DreamHost is offering notified customers one year of Equifax credit monitoring and identity theft protection, and suggests a fraud alert or credit freeze. Those steps cover identity fraud. They do not inspect your website or your mailbox, which is exactly where the exposure was.
FAQ
Did DreamHost confirm a data breach of FTP logins?
Yes. DreamHost says an attacker exploited its web File Manager and could access FTP/SFTP usernames and passwords of users who logged in between roughly August 2026 and October 23, 2026.
Were DreamHost control panel or credit card details stolen?
DreamHost says it found no evidence that control panel login information or billing and payment details were accessed. Payment processing is handled by an external provider.
Is there a CVE for the DreamHost File Manager vulnerability?
No CVE, affected version or flaw type has been published. DreamHost says only that the vulnerability has been addressed.
Does changing my DreamHost password remove malware already uploaded?
No. The reset stops the old login, but any webshell, redirect or rogue admin added with those credentials stays until you remove it.
If you cannot account for every file that changed on your DreamHost site since August, our team can help you clean and protect your site, including backdoor removal and firewall monitoring.