DreamHost discloses stolen FTP credentials and possible webmail exposure
Image: Primary DreamHost says attackers stole FTP/SFTP usernames and passwords through a vulnerability in its web-based File Manager, BleepingComputer reported. Its breach notification identifies an exposure period from August 2026 to October 23, 2026, when the intrusion was discovered, adding detail to its earlier warning requiring password resets.
The attacker may also have accessed webmail session information, including credentials, for a limited number of users. DreamHost says it blocked access, fixed the vulnerability, ended potentially affected sessions and invalidated passwords.
Notification recipients are advised to check website files for unauthorized changes and review webmail forwarding rules. DreamHost says it found no evidence of access to control panel logins or billing/payment details.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
