--- title: "DreamHost breach: two months of access, FTP/SFTP credentials stolen" description: "DreamHost has confirmed that an attacker had access to its web file manager for about two months and stole customers' FTP/SFTP credentials. Some webmail sessions may also have been exposed, so you should change your passwords and check your sites and mailboxes." canonical: https://inyourgeek.com/en/articles/2026-11-05-dreamhost-deux-mois-d-intrusion-des-identifiants-ftp-sftp type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-11-05 dateModified: 2026-11-05 section: "Security" tags: ["dreamhost", "fuite", "hebergement", "ftp"] --- # DreamHost breach: two months of access, FTP/SFTP credentials stolen > DreamHost has confirmed that an attacker had access to its web file manager for about two months and stole customers' FTP/SFTP credentials. Some webmail sessions may also have been exposed, so you should change your passwords and check your sites and mailboxes. November 5, 2026 · Security · 3 min DreamHost, the US web host and domain name registrar, has sent a data breach notification to some of its customers. [BleepingComputer](https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/) reported it on 4 November 2026. The letter follows an earlier announcement of a cybersecurity incident, which had already asked users to reset their email and FTP/SFTP passwords. Everything below comes from that single press source, which relies on the host's notification. ## An intrusion from August to 23 October According to the notification, an unauthorised third party gained access to the server that runs DreamHost's web file manager, files.dreamhost.com. They exploited a vulnerability in that software and were able to collect the FTP/SFTP usernames and passwords of people who logged in to it between around August 2026 and 23 October 2026. That is the date the intrusion was discovered. The attacker was also able to reach the webmail systems. For a limited number of users, session information, including credentials, may have been exposed. DreamHost says the attack appears to be deliberate, and that its teams are working around the clock to contain it fully. The number of affected accounts has not been disclosed. BleepingComputer says it asked the host about this several times and got no answer. ## What DreamHost says it has done The host says it has cut off the attacker's access and fixed the vulnerability that was exploited. It ended the active sessions of potentially affected users and invalidated their passwords. So far, it says it has found no sign of access to control panel credentials, or to billing and payment data, which is handled by an outside provider. ## The credentials to change If you used DreamHost's file manager between August and 23 October 2026, assume that a third party knows your FTP/SFTP credentials. Your old password has been invalidated. Choose a new one that you do not use anywhere else, then update the FTP clients, deployment scripts and continuous integration tools where the old one was saved. Do the same for your email. DreamHost's first announcement had already asked you to reset that password. Next, change the password of any other account where you used the same credentials. This is one of the recommendations given to the people who received the notification. Those recipients are also being offered one year of credit monitoring and identity theft protection through Equifax. They are encouraged to consider placing a fraud alert or a security freeze on their credit file. ## Checking your hosting Changing a password closes the door, but it does not undo anything that was changed while the door was open. DreamHost recommends two checks. The first concerns your website files. Look for changes you did not make yourself: added files, unfamiliar scripts, altered pages. If your site is under version control or backed up, compare what is on the server now with a copy from before August, and start with the files modified during the exposure period. The second concerns webmail. Review the forwarding rules and filters on each mailbox. A quiet redirect to an outside address, or a filter that sorts or deletes certain messages, does not go away when you change your password. Remove anything you did not set up. The exposure period is now known: August to 23 October. The number of people affected is still not. ## Sources - [DreamHost confirms data breach exposed FTP logins and webmail sessions](https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-11-05-dreamhost-deux-mois-d-intrusion-des-identifiants-ftp-sftp Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives