WASHINGTON — DreamHost has confirmed a data breach in which hackers exploited a flaw in its web-based File Manager to steal FTP and SFTP usernames and passwords, and reached webmail login data for a limited number of customers. The web hosting company says the intrusion began in August 2026 and ran until it was discovered on October 23. DreamHost filed a breach notice with the California Attorney General on November 2 and is offering affected people one year of credit monitoring through Equifax.
The DreamHost hack is the latest credential exposure at one of the longest-running shared hosts on the web, which serves millions of WordPress and small-business sites. The company first forced password resets on October 23 without explaining why. On October 29 it published an incident notice confirming that credentials had been stolen.
Never Miss An UpdateFollow us on Google News to get our latest security, defense and cyber reporting in your feed. It’s free and takes one tap.
Follow on Google News“We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com.”
— DreamHost breach notification letter
DreamHost Data Breach at a Glance
| Company | DreamHost, LLC |
| System breached | Web-based File Manager (files.dreamhost.com) and some webmail systems |
| Attack method | Exploited vulnerability in third-party software behind the File Manager |
| Exposure window | August 2026 – October 23, 2026 |
| Data stolen | FTP/SFTP usernames and passwords; webmail credentials and session data for a limited number of users |
| Not affected (per DreamHost) | Control panel logins, billing and payment details |
| Scope | “Well under” 10% of hosted email and FTP/SFTP accounts |
| Remedy | Forced password resets; 12 months of Equifax credit monitoring |
How the DreamHost Hack Happened
The DreamHost File Manager lets customers edit website files in a browser instead of using a desktop FTP client. According to DreamHost, the attacker exploited a vulnerability in the third-party software that powers the tool and harvested the FTP and SFTP credentials of every customer who signed in to it during the exposure window. DreamHost said the attack appears to have been deliberate.
The intruder also reached certain webmail systems and obtained login credentials for a smaller group of users. DreamHost believes the attacker may have viewed the contents of some mailboxes and says it is contacting those customers individually. The company has not named the third-party software, attributed the attack to any group, or said whether a CVE has been assigned. It said the incident is unrelated to recent PHP updates on its servers.
What Data Was Exposed in the DreamHost Breach
The stolen data centers on access credentials rather than identity records. The California filing lists usernames and passwords as the information involved. DreamHost says it found no evidence that control panel logins or billing details were accessed. Payments are handled by an outside processor, and the host does not store full card numbers.
DreamHost estimates that “well under” 10% of hosted email and FTP/SFTP accounts were affected. It says it sent precautionary reset notices to more customers than it now believes were exposed, so a reset email alone does not prove an account was compromised. The company has not released an absolute number, and BleepingComputer reported that repeated questions about the count went unanswered.
Stolen FTP passwords are dangerous because they grant write access to a website’s files. An attacker with them can plant backdoors, card skimmers or spam pages on a customer’s site, or add hidden WordPress administrator accounts. That makes this breach a risk to website visitors, not just to DreamHost account holders. The pattern echoes other recent incidents Homeland411 has covered, including the Harvard alumni database breach and the Cosme data leak.
DreamHost Breach Timeline
| Date | Event |
|---|---|
| August 2026 | Unauthorized access to the File Manager server begins (California AG listing gives August 15) |
| October 23 | DreamHost discovers the intrusion, takes File Manager offline, resets exposed passwords and ends webmail sessions |
| October 23–25 | Reset emails go out; some customers are locked out of email and FTP until owners set new passwords |
| October 29 | DreamHost publishes its incident notice confirming stolen credentials |
| November 2 | Breach notification filed with the California Attorney General |
| November 4 | Plaintiff law firms announce DreamHost data breach investigations |
DreamHost says it fixed the vulnerability, preserved the compromised server for forensic work, and relaunched a rebuilt File Manager with added monitoring. It also rotated internal credentials that may have been exposed, brought in outside forensic specialists, and is reviewing other customer-facing tools for similar weaknesses. Websites stayed online and incoming mail kept arriving throughout.
What DreamHost Customers Should Do Now
Anyone who used the DreamHost File Manager between August and October 23 should treat those FTP and SFTP credentials as compromised. DreamHost cannot contact individual mailbox or FTP users directly, so account owners need to alert the people they manage.
- Reset passwords in the panel: Set new mail passwords under Mail > Manage Email and new FTP/SFTP passwords under Websites > SFTP Users & Files. Changes can take up to 15 minutes to apply.
- Update saved logins: Enter the new passwords in mail apps, phones and FTP clients.
- Audit website files: Look for unfamiliar PHP files, edited .htaccess files and unknown WordPress admin users.
- Check webmail rules: Remove any forwarding rules or filters you did not create.
- Replace reused passwords: Change any other account that shared the same or a similar password.
- Enroll in monitoring: Use the Equifax offer in DreamHost’s letter, and consider a fraud alert or credit freeze.
Expect phishing that imitates breach notices. DreamHost said its incident emails never ask for a password or contain sign-in links: “DreamHost will never email you asking for your password.” Go to panel.dreamhost.com by typing the address yourself. Our guide to checking whether your data was leaked covers breach-lookup tools.
Earlier DreamHost Hacks
This is not the first time FTP credentials have been at the center of a DreamHost security incident. In June 2007, attackers abused a flaw in the company’s web control panel and compromised about 3,500 FTP accounts, The Register reported. In January 2012, DreamHost detected unauthorized access to one of its database servers and forced resets of FTP and shell passwords across its customer base. Neither of those incidents exposed billing data, according to the company at the time.
DreamHost Data Breach Lawsuit Investigations
Plaintiff firms including Strauss Borrelli PLLC and Shamis & Gentile announced this week that they are investigating the DreamHost data breach for possible class claims. No lawsuit had been reported as filed as of Thursday. The final number of affected people, which DreamHost has not disclosed, is likely to shape any litigation.
What to Watch
- Affected count: Filings in states such as Maine and Texas usually list totals, which DreamHost has not yet disclosed.
- The vulnerable software: If the File Manager component is named, other hosts running it may need to patch.
- Mailbox notices: Individual letters to customers whose email may have been read are due in the coming days.
- Website compromises: Reports of malware on DreamHost-hosted sites would show whether stolen FTP logins were used.
