Confirmed

DreamHost: File Manager flaw exposed FTP/SFTP credentials

A vulnerability in the web-based File Manager server was exploited to access users’ FTP/SFTP usernames and passwords.

Last updated: 2026-11-09

Overview

Discovered between August and October 23, 2026; email and file contents may also have been reachable. No total is given.

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

Sample consumer notice filed with California AG (DreamHost, LLC)California Department of Justice, Office of the Attorney General · 2026-11-09
California AG data breach report: DreamHost, LLCCalifornia Department of Justice, Office of the Attorney General · 2026-11-09