DreamHost File Manager incident: how to tell if your FTP or email was hit
Quick answer
DreamHost says that on Oct 23 it found an unauthorized party on the server that runs its browser File Manager at files.dreamhost.com. Attackers who used that access could see FTP/SFTP usernames and passwords for people who logged into File Manager from roughly August 2026 through Oct 23, and a limited number of webmail credentials (DreamHost notice). DreamHost reset affected passwords, ended sessions, fixed the vulnerability, and rebuilt File Manager. Formal customer notices followed in early November (BleepingComputer, Nov 4).
Who’s affected
- In scope: FTP/SFTP users who logged into the web File Manager between about August 2026 and Oct 23, 2026. Treat those usernames and passwords as compromised.
- Email: some mailboxes were force-reset on/after Oct 23 as a precaution; a limited set of webmail sessions may have been exposed. In a small number of cases DreamHost believes mailbox contents may have been viewed and is contacting those customers directly.
- Not shown as hit: DreamHost says it has found no evidence the attacker got control-panel logins or billing/payment details (card payments go through an outside processor).
- Scale: DreamHost currently says a fraction of email and FTP/SFTP accounts — well under ~10% — appear affected. If you never got an email about this, it says no action is needed right now, though the precautions below are still cheap insurance.
How to check
- Look for DreamHost’s incident email (it will not ask for your password or send you a “click here to reset” login link).
- Try an old FTP/SFTP or email password you never changed yourself. If it still works and you have not reset it, DreamHost’s investigation so far says it was not exposed — still worth rotating.
- If you were signed out and the old password stopped working on/after Oct 23, that was DreamHost’s reset: set a new one in the control panel.
- Unsure? Ask support from inside https://panel.dreamhost.com/support/ (type the address; don’t follow random links).
What to do if you’re in scope
- Reset passwords for every affected FTP/SFTP and email user from the DreamHost account control panel (only the account holder can). Allow up to ~15 minutes for the change to stick.
- Update saved clients (FileZilla, Cyberduck, mail apps) that still hold the old password.
- Scan website files for changes you did not make.
- Check webmail forwarding rules and filters for anything you did not set.
- Change reused passwords on any other site where you used the same string.
- Watch for phishing. DreamHost will not email asking for your password. Change passwords only at https://panel.dreamhost.com/.
FAQ
- Were my sites taken down? DreamHost says websites and email stayed up; inboxes still receive mail even before you reset.
- Was this the PHP patch wave? DreamHost says no — PHP servers were patched quickly and its WAF blocked related intrusion attempts.
- Credit monitoring? BleepingComputer reports that DreamHost is offering notified individuals one year of Equifax credit monitoring and identity-theft protection (BleepingComputer, Nov 4). Follow the letter you actually received.