# DreamHost Confirms Data Breach Exposing Customer Credentials and Webmail Access Hackers exploited a File Manager vulnerability to access sensitive FTP and webmail account data. - **Source:** [Latest from TechRadar](https://www.techradar.com/feeds.xml) - **Published:** 2026-11-05 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/56acb57c-1dee-4f90-8463-f048774fb47f ## Unauthorized Server Access DreamHost recently disclosed a significant security breach involving unauthorized third-party access to its web-based File Manager service. The incident occurred throughout August 2026, allowing attackers to exploit a specific software vulnerability. This compromise potentially exposed FTP and SFTP credentials, alongside session data for a limited number of webmail users. ## Scope of Compromised Data The attackers gained access to login credentials, which puts all information stored within the File Manager and affected webmail accounts at risk. While the company confirmed these credentials were stolen, it stated there is currently no evidence that attackers accessed control panel login information or sensitive customer billing details. ## Payment Security Status DreamHost clarified that it does not store full payment card numbers on its systems. Instead, the company retains secure tokens representing payment information, which cannot be used for unauthorized purchases elsewhere. This architectural decision likely prevented the attackers from stealing raw financial data during the intrusion into the server. ## Immediate Remediation Steps In response to the discovery, DreamHost terminated all active sessions for potentially affected users and forced password resets. The company urged customers who find their accounts locked to treat their data as breached. Additionally, they have implemented unspecified security measures to patch the vulnerability and prevent future unauthorized access attempts. ## Risk of Secondary Attacks The stolen credentials pose a severe threat, as they could facilitate spam distribution, phishing campaigns, or sophisticated Business Email Compromise attacks. These methods are notoriously difficult to detect and can lead to further organizational damage. DreamHost has advised customers to monitor their credit reports and report any suspicious account activity. ## Support for Affected Users To assist those impacted by the breach, DreamHost is providing one year of complimentary credit report monitoring and identity theft protection services through Equifax. This is a standard industry response to such incidents. Customers are encouraged to place fraud alerts on their credit reports to mitigate potential long-term identity theft risks. ## Historical Security Context This incident marks another security challenge for DreamHost, which previously suffered a database server breach in 2012 that exposed FTP and shell-access passwords. Furthermore, the company faced a major Distributed Denial of Service attack in 2017, which targeted its DNS infrastructure and caused widespread connectivity issues for its global customer base. ## Ongoing Investigation Status The investigation into the August 2026 breach remains active, with DreamHost working alongside outside legal counsel and forensics experts. No threat actors have claimed responsibility, and the stolen data has not yet appeared on the dark web. The company has promised to provide updates if significant new information becomes available. ## Sources covering this story - https://www.techradar.com/pro/security/dreamhost-admits-major-cyberattack-saw-hackers-steal-customer-data-and-access-inboxes — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._