US web host and domain registrar DreamHost confirmed a data breach after attackers gained access to the server running its web-based File Manager (files.dreamhost.com) between August 2026 and 23 October 2026, when the intrusion was discovered. In a breach notification filed with the California Attorney General, DreamHost says the unauthorised third party exploited a vulnerability in the File Manager software to access the FTP/SFTP usernames and passwords of individuals who logged in during the period, and may have accessed webmail systems, exposing session information including credentials for a limited number of users. The company found no evidence that control-panel logins or customer billing and payment details — handled by an external provider — were accessed, has blocked the attackers, invalidated passwords, terminated active sessions and addressed the exploited vulnerability. Impacted customers are offered a year of Equifax credit monitoring; the total number of affected accounts has not been disclosed. Affected users should audit website files, webmail forwarding rules and reused credentials.

• Source article