Web hosting provider DreamHost has confirmed a data breach after an unauthorized third party exploited a vulnerability in its web-based File Manager and stole the FTP and SFTP usernames and passwords of customers who logged in to the tool over roughly 2 months. The attacker also reached certain webmail systems, obtained the login credentials or session data of a limited number of webmail users and, in a small number of cases, may have viewed mailbox contents.
The company said it discovered the intrusion on the afternoon of Friday, October 23, 2026, and that the activity began around August 2026. A breach notice filed with the California Attorney General’s office lists the breach date as August 15, 2026.
What DreamHost says happened
According to DreamHost’s incident notice, the File Manager at files.dreamhost.com is a browser-based tool built on third-party software that customers use to work on the files behind their websites. The attacker exploited a vulnerability in that software and was able to capture the FTP and SFTP credentials of anyone who signed in to the File Manager before the activity was detected.
DreamHost described the incident as “a deliberate attack.” It has not named the vulnerable software, identified the vulnerability or said who was behind the intrusion. The company also said the incident was not related to the recent PHP2Shell vulnerabilities, stating that its PHP servers were patched within hours and that its web application firewall blocked tens of thousands of intrusion attempts in the days before those fixes were released.
What data was exposed
The notification letter sent to affected customers says the accessed data may include:
- Usernames and passwords used to access the File Manager
- FTP and SFTP usernames and passwords
- Webmail session information, including session credentials, for a limited number of users
- Contents of email and files stored on FTP and SFTP servers
DreamHost said it found no evidence that the attacker accessed control panel logins or customer billing details. The company does not store full payment card numbers, and card payments are handled by a third-party processor.
DreamHost has not disclosed how many customers were affected. Its notice says the incident affected “a fraction of email and FTP/SFTP accounts hosted at DreamHost, well under approximately 10%.” The company says its investigation found fewer affected customers than first suspected, and that not everyone who received its first password reset email was affected.
How DreamHost responded
After discovering the breach, DreamHost took the File Manager servers offline, preserved the affected server for forensic review and rebuilt the tool with added monitoring before bringing it back. It also reset the passwords of email, FTP and SFTP users whose credentials may have been exposed, ended active sessions and rotated internal credentials that may have been exposed.
The company said it has hired outside security and forensics experts, is reviewing its other customer-facing tools for similar flaws and is notifying regulators as required by law. Affected customers in the United States are being offered 1 year of free credit monitoring and identity theft protection through Equifax.
What DreamHost customers should do
DreamHost says anyone who, or any FTP or SFTP user on their account who, logged in to the File Manager between about August 2026 and October 23, 2026 should treat those usernames and passwords as compromised. Only the DreamHost account holder can set new passwords for mail, FTP and SFTP users from the control panel, and a new password may take up to 15 minutes to take effect.
- Set new, unique passwords for every email, FTP and SFTP user on the account, and update any mail or FTP clients that saved the old ones.
- Change the same password anywhere else it was reused.
- Look over website files for any changes you do not recognize.
- Review webmail forwarding rules and filters and remove any you did not create.
- Type panel.dreamhost.com directly into your browser instead of clicking links in emails.
DreamHost warned that incidents like this are often followed by phishing emails that copy the company’s branding. It says it will never email customers asking for a password, and its incident emails will never ask users to sign in through a link. Readers who are unsure whether a message is genuine can follow our guide on how to check a suspicious email safely.
DreamHost’s breach notices arrive in the same week as the OpsShield cPGuard supply chain attack that pushed backdoored updates to about 2,950 hosting servers, though there is no indication the 2 incidents are connected.
Website owners who stored their own customers’ data on DreamHost may have their own notification duties, and DreamHost has advised them to consult legal counsel. The company said its investigation is ongoing and that it will share significant new findings with users and regulators.
