A popular web host is warning customers that File Manager logins were harvested for months.
Around November 4, 2026, DreamHost notified users about unauthorized access to its files.dreamhost.com File Manager server between August 2026 and October 23, 2026. An attacker exploited a vulnerability and obtained FTP and SFTP usernames and passwords for people who logged into File Manager during that window.
What may also have been reached
DreamHost said the attacker may have reached certain webmail systems and obtained session information for a limited number of webmail users. The company believes the intrusion was deliberate, says it has been contained, addressed the vulnerability, stopped sessions and invalidated passwords.
There was no evidence of control-panel login compromise or access to billing and payment systems, which sit with an external provider. Still, FTP and SFTP credentials are enough for an attacker to alter site files, plant malware or quietly change mail filters.
What users should do
DreamHost advised customers to check site files for unauthorized changes, review webmail forwarding rules and filters, and change any reused passwords. The company is offering one year of Equifax credit monitoring and identity theft protection. Agencies that manage client sites on DreamHost should treat this as a forced credential rotation and content audit across every account that used File Manager in that window.
Why it matters
Hosting and SaaS side tools remain high-risk. Agencies and IT buyers should push vendors on File Manager and SSH credential hygiene and least-privilege admin surfaces.
If you manage customer sites, treat web file managers as privileged attack surface — and ask hosts how long credential exposure windows can go undetected.
Source: BleepingComputer, The Hacker News. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.