DreamHost says attackers sat in its File Manager for two months

DreamHost has confirmed a breach of the server behind its web-based File Manager at files.dreamhost.com. In a notification quoted by BleepingComputer, the company says an unauthorised third party exploited a vulnerability in that software and got at the FTP/SFTP usernames and passwords of people who logged in between roughly August 2026 and October 23, 2026, the day it was found.

The intruder may also have reached webmail systems, exposing session information including credentials for a limited number of users. DreamHost says it has found no evidence that control panel logins or billing and payment details were touched; payments are handled by an external provider.

The company says it blocked the access, fixed the vulnerability, killed active sessions for potentially affected accounts and invalidated passwords. It's offering a year of credit monitoring and identity theft protection through Equifax.

How many accounts were caught up in this is still unknown. BleepingComputer says it asked DreamHost repeatedly and got no answer, so treat any figure you see elsewhere with suspicion.

For anyone who got a letter: check website files for changes nobody made, look over webmail forwarding rules and filters, and change the same credentials anywhere else they were reused. FTP passwords are often old and shared with other things, which is the part we'd deal with first.