DreamHost says an attacker spent about two months inside its File Manager tool and took website login details. Customers should check their sites and email.
DreamHost, a web hosting company and domain registrar, has confirmed a data breach. An attacker got into the system behind its online File Manager and stole the usernames and passwords people use to upload files to their websites. The break-in ran from about August 2026 until the company found it on October 23, 2026.
The File Manager is a tool that lets customers manage website files from a web browser. DreamHost says an unauthorized person got into the server that runs it, at files.dreamhost.com, by exploiting a flaw in the software. That gave the attacker the FTP and SFTP logins of anyone who used the File Manager during that period. FTP and SFTP are the standard ways to send files to a website.
The company also says the intruder may have reached its webmail systems. For a limited number of users, that could have exposed session information, including credentials. A session is the record that keeps you signed in while you use your email. DreamHost describes the attack as deliberate.
A stolen file transfer login can let someone change a website without the owner knowing. That could mean adding harmful content or altering pages. Access to webmail raises a different risk. An attacker could read messages or set up rules that quietly forward mail elsewhere. People who reuse one password on several accounts face extra risk, because a stolen password can be tried elsewhere.
DreamHost says it found no evidence that the attacker reached control panel login information or customer billing and payment details. An outside provider handles payments. That is reassuring, but it is not a guarantee, and the investigation may not be finished. The company says it has blocked the attacker, fixed the flaw, ended active sessions for potentially affected users and invalidated their passwords.
The alert box above lists the steps. In short, change your passwords, look over your website and email settings, and watch your credit. DreamHost is offering one year of credit monitoring and identity theft protection through Equifax to affected people. It also urges them to consider a fraud alert or a security freeze on their credit report.
BleepingComputer asked DreamHost several times how many accounts were affected and got no answer. The number of webmail users involved is described only as limited. Until DreamHost shares more, customers who used the File Manager or webmail since August should assume they could be affected.
If your site or email is on DreamHost, change your passwords now and check for changes or forwarding rules you did not set up.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
