Breaches · 4h ago
DreamHost says attackers exploited an unspecified File Manager vulnerability in an intrusion that began in August, accessing customer files and emails and obtaining FTP/SFTP credentials and webmail session tokens.
A session token is temporary proof that someone has already signed in; whoever holds it may enter as that user without the password. Stolen FTP/SFTP credentials could also provide access to hosted files, so the exposure reaches beyond content in DreamHost’s file manager.
DreamHost says the affected customer count is “well under 10%” but gave no precise figure. For organizations hosting sites or mail with DreamHost, the stolen access could extend the breach into files and inboxes, while the disclosure leaves which accounts were exposed—and for how long—unclear.
2 sources covering this story
Hackers stole DreamHost customer files and inboxes during months-long attack | TechCrunch
The web host said hackers exploited a vulnerability to access customer emails and files during a "deliberate attack."
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.
Part of the PlainSec briefing for 2026-11-04