DreamHost says attackers stole customer passwords for more than two months

U.S. web hosting provider DreamHost has informed its customers that an unauthorized third party accessed its systems from August 2026 until October 23, the day it detected the attack, according to Infobae, based on the company's notice. The intruder got into the File Manager server, the web tool users rely on to manage their sites' files, by exploiting a vulnerability in third-party software that the company has not identified.

According to that notice, the attacker obtained the FTP and SFTP usernames and passwords of those who used File Manager during that period and reached some webmail systems, where it obtained credentials for a limited number of users. DreamHost believes that in "a handful of cases" it may have read mailboxes and is contacting those customers one by one. A notice filed with the California attorney general's office also mentions the theft of webmail session cookies, according to Infobae.

The company says those affected are "well under 10%" of its email and FTP accounts, without giving an exact figure; DreamHost claims about 400,000 paying customers. It has closed active sessions and reset the passwords of potentially affected users, is asking customers to change passwords reused on other services and is offering one year of credit monitoring. So far it has found no access to the control panel or billing data, and says it does not store full card numbers.

Developing story: we have not been able to access DreamHost's original notice to its customers or the filing with the California attorney general's office, and we do not know the exact date of the notice or the number of affected accounts. The information comes from Infobae, which cites the notice and statements by a spokesperson to TechCrunch.