Web hosting giant DreamHost has confirmed that intruders broke into its systems through a flaw in the company’s browser-based File Manager tool, making off with a batch of customer login credentials and, in a small number of cases, reading the contents of private mailboxes. The disclosure follows an earlier round of unexplained password resets that had left customers guessing about what had actually happened.

A Break-In Through a Familiar Convenience Tool

File Manager is the kind of feature most hosting customers barely think about: a point-and-click interface baked into the control panel that lets people upload, edit, and rearrange website files without touching an FTP client. According to DreamHost’s own incident notice, that convenience is exactly what attackers turned against the company. A vulnerability in third-party software underpinning the tool gave intruders a way in, though DreamHost has not named the vulnerable component, described how the flaw works, or published a CVE identifier for it.

DreamHost says it first spotted unauthorized access on October 23, 2026, and that its forensic review now points to a far longer exposure window stretching back to roughly August. In other words, whatever foothold the attackers found may have gone unnoticed for close to two months before it was caught.

What Was Actually Taken

The company says the intrusion let attackers collect FTP and SFTP usernames and passwords tied to File Manager, along with webmail credentials for a limited set of accounts. In some of those cases, investigators believe the attackers went further and actually viewed the contents of private mailboxes, rather than simply harvesting login details.

DreamHost has been careful to frame the scope narrowly. It estimates that well under 10% of its hosted email and FTP/SFTP accounts were affected, and stresses that figure describes a share of accounts, not a confirmed count of individual customers. Some people received precautionary password-reset notices even though their credentials were never actually exposed, a common move when a company would rather over-notify than miss someone who was genuinely at risk.

On the brighter side of the ledger, DreamHost says it has found no evidence that control-panel logins or billing records were accessed, and that full payment card numbers were never at risk in the first place because an outside processor, not DreamHost’s own servers, handles card payments.

The Response So Far

Once the File Manager server was identified as the entry point, DreamHost took it offline, preserved it for forensic analysis, and rebuilt the service with additional monitoring and safeguards before bringing it back online. The company also reset internal credentials that may have been exposed during the intrusion and says it has brought in external security specialists to help with the investigation.

That work is ongoing. DreamHost is reviewing its other customer-facing tools for similar weaknesses and says it is in the process of notifying relevant regulators, as required when personal data may have been exposed. Investigators are also reaching out individually to the customers whose mailboxes they believe were actually viewed, rather than making a blanket announcement to everyone with an affected account type.

One detail worth flagging for anyone trying to size up their own risk: separate security research has shown how stolen session cookies, not just stolen passwords, can let an attacker read someone’s email without ever needing to log in again. DreamHost’s notice doesn’t explicitly say whether session tokens were part of what was taken here, so that possibility shouldn’t be assumed based on the current disclosure, but it’s a reason ending active sessions matters as much as rotating passwords.

What Affected Customers Should Do

• Treat any FTP/SFTP or webmail password used with File Manager between August and October 23 as compromised, and change it even if DreamHost hasn’t flagged your account directly.
• Watch for a direct notice from DreamHost if you’re among the customers whose mailbox contents may have been viewed, and follow any specific instructions it contains.
• Enable two-factor authentication wherever DreamHost offers it, and avoid reusing the same password across your hosting account and other services.
• Review recent website file changes for anything unexpected, since File Manager access could in theory have let an attacker alter site content as well as read credentials.
• Keep an eye out for phishing emails that reference this breach, since attackers often use public disclosures like this one as bait for follow-on scams.

DreamHost’s handling of the incident, so far, follows a fairly standard breach playbook: contain the entry point, rotate credentials, bring in outside help, and notify regulators. What remains unresolved is the harder question of exactly how long attackers sat inside File Manager undetected, and whether the real number of affected mailboxes will grow as the investigation continues.