# DreamHost confirms major breach of customer credentials

> Web hosting provider DreamHost says hackers exploited a vulnerability to steal FTP passwords and webmail session data from customers in August 2026.
- Title: DreamHost confirms major breach of customer credentials
- Summary: Web hosting provider DreamHost says hackers exploited a vulnerability to steal FTP passwords and webmail session data from customers in August 2026.
- Keywords: dreamhost, cyberattack, data breach, ftp credentials, webmail, file manager, vulnerability, customer data, TechRadar
- Source: TechRadar — https://techradar.com/pro/security/dreamhost-admits-major-cyberattack-saw-hackers-steal-customer-data-and-access-inboxes
- Published: 2026-11-05T14:37:33+00:00
- Read time: 1 min
- Topics: dreamhost, cyberattack, data breach, ftp credentials, webmail, file manager, vulnerability, customer data, technology
## DreamHost discovers unauthorized access
Web hosting provider DreamHost discovered unauthorized third-party access to its File Manager server at files.DreamHost.com roughly two weeks before disclosure.
## Attack happened in August 2026
DreamHost said the unauthorized access occurred during August 2026 when threat actors exploited a vulnerability in the File Manager software.
## Hackers stole login credentials
The vulnerability gave attackers access to FTP and SFTP usernames and passwords of logged-in individuals, plus webmail session information from a limited number of users.
## Stolen credentials enable serious attacks
Access to login credentials means attackers can read stored files and emails, and use compromised accounts to launch phishing attacks or Business Email Compromise attacks.
## Payment data appears uncompromised
DreamHost found no evidence that attackers accessed control panel login information or customer billing details. The company does not store full payment card numbers.
## DreamHost's immediate response
DreamHost terminated active sessions of affected users, reset their passwords, and addressed the exploited vulnerability. It is working with legal advisors and security experts.

> We believe this as a deliberate attack, and our team worked around the clock to contain it.
## Customers offered credit monitoring
DreamHost urged customers to review statements, monitor credit reports, place fraud alerts, and notify police of suspicious activity. It offered one year of free credit monitoring.
## No public claims or leaked data yet
So far, no threat actors have claimed responsibility for the breach, and the stolen data has not yet appeared on the dark web.
## DreamHost's history of security incidents
This is not DreamHost's first breach. In 2012, attackers accessed a database server exposing FTP and shell-access passwords. In 2017, the company suffered a major DDoS attack.
## Key takeaway

DreamHost disclosed a cyberattack in which hackers stole customer FTP and webmail credentials by exploiting a vulnerability in its File Manager service during August 2026.