What Happened
DreamHost is warning of a data breach that hit its File Manager platform. According to BleepingComputer, attackers had access for about two months and stole customers' FTP/SFTP usernames and passwords. The same breach exposed webmail sessions. This is a DreamHost File Manager data breach, and it matters to MSPs because those credentials are often the keys to a client's website.
The company has not made a customer count public, and the reporting does not say how the attackers got in. What is known is that the access lasted roughly two months and that the stolen data is the kind that lets someone manage a website's files.
A breach at a hosting provider is not like a breach at a single business. One host can hold credentials for many small companies, and many of those companies are MSP clients. That is why this story belongs on your radar even if you do not use DreamHost yourself.
Timeline
The public reporting so far gives one dated event. DreamHost has not published the start or end of the access window.
- November 4, 2026BleepingComputer reports DreamHost is warning of a data breach involving its File Manager platform.
Who Is Affected
Anyone with a DreamHost account who used the File Manager platform could be affected. The exposed data includes FTP/SFTP usernames and passwords, which are the credentials used to upload, download, and manage files on a hosted website. Webmail sessions were exposed too, so anyone who used DreamHost webmail during that two-month window should treat the session as a risk.
For MSPs, the affected group is wider than one login. Any client site you manage that is hosted on DreamHost and uses File Manager is potentially in scope, and you may not know yet which accounts were touched.
As a standing practice, also check any control panel or other service that shares a login with the File Manager platform. The public reporting does not say those were affected, but separating credentials across services limits the blast radius of any breach.
Technical Details of the DreamHost File Manager Data Breach
The affected product is the DreamHost File Manager platform. The exposed data is customers' FTP/SFTP usernames and passwords, and the reporting also lists webmail sessions. The attackers had access for about two months.
No CVE has been published for this incident. The public reporting does not name a specific DreamHost software version, and it does not describe the initial attack vector. If DreamHost releases more technical detail, that is where it will appear.
Why This Matters for MSPs
FTP and SFTP credentials are high-value targets. With them, an attacker can log into a website's file system, read source code, plant malicious files, and in some cases move sideways into other services. They do not need a flaw in your client's application if they already have the hosting credentials.
For an MSP, a breach like this lands in your lap because you are the one who manages the hosting relationship. The practical move is to assume nothing, inventory every DreamHost account you touch, and rotate credentials before a problem shows up.
Credential reuse is where a breach like this turns into something worse. If a client used the same FTP password for their email account or their billing portal, an attacker now has a working login to try elsewhere. That is a standard pattern after a credential breach, so it belongs in your response plan.
What to Do This Week
Work through this list even if you have not received a notification from DreamHost. The point is to reduce the value of the stolen credentials before an attacker uses them.
- Inventory every DreamHost account you touch. This includes your own accounts, client accounts, and any reseller or sub-account that uses File Manager.
- Rotate FTP and SFTP passwords on every affected DreamHost account. Do this before DreamHost's notification arrives if you know you use the platform.
- Log out active webmail sessions and force a fresh login for anyone who may have used DreamHost webmail in the past two months.
- Turn on multi-factor authentication wherever DreamHost supports it, especially for control panel and webmail access.
- Check hosted sites for signs of tampering. Look for recently modified files, unfamiliar uploads, new users, and unexpected scripts.
- Find every place a client reused the same password and change those passwords too. Credential stuffing is a standard follow-up after breaches like this.
What to Tell Clients
DreamHost has confirmed a data breach involving its File Manager platform. Attackers had access for about two months and may have taken FTP and SFTP usernames and passwords. Webmail sessions were exposed as well.
We are reviewing any DreamHost accounts tied to your hosting and rotating the passwords on those accounts. We are also checking your site files for anything unusual.
If you used the same password on DreamHost anywhere else, change it there now. Use a unique password for every service, and let us know if you need help setting that up.
The public reporting does not mention payment card data, but we are treating this as a credential breach and taking it seriously.
Keep checking MSP Outpost for updates on this one. We will add new details as they become public.
Frequently Asked Questions
What Is the DreamHost File Manager Data Breach?
DreamHost is warning that attackers gained access to its File Manager platform for about two months and stole customers' FTP/SFTP usernames and passwords. The breach also exposed webmail sessions. The public reporting does not include a CVE, a specific version, or an attack vector.
Was My FTP or SFTP Password Exposed?
If you used DreamHost File Manager, there is a reasonable chance your FTP or SFTP credentials were among the data accessed. DreamHost has not published a list of affected accounts, so the safe move is to treat your credentials as exposed and rotate them now.
Is DreamHost File Manager Still Safe to Use?
DreamHost has not said the platform is unsafe to use now. In the meantime, rotate your passwords, enable multi-factor authentication where it is offered, and watch your accounts for unauthorized activity.
What Should I Do If I Reused My DreamHost FTP Password Elsewhere?
Change it everywhere you used it. Attackers often take stolen credentials and try them against other services, so any password reuse turns a single breach into a wider risk. Focus first on email, banking, and hosting control panels.
Did This Breach Affect DreamHost Webmail?
The reporting says webmail sessions were exposed in the same breach. Log out of active webmail sessions, force new logins, and watch for signs that an attacker used an open session.
Should I Change My DreamHost Account Password?
Yes, along with FTP and SFTP passwords. Even though the reporting focuses on File Manager credentials, a hosting account password is a sensible thing to rotate after any breach at a host.
Sources
- DreamHost confirms data breach exposed FTP logins and webmail sessionsBleepingcomputer · Reported
What This Touches
Check these in your stack and your clients'.