-
From about August 2026 until October 23, hackers exploited a flaw in DreamHost’s File Manager to access website login details.
-
DreamHost says attackers hit well under 10% of its email and FTP accounts. It found no sign of stolen billing data or control panel logins.
-
If you got a notice, reset your passwords. Then check your site files and email rules, and watch for scam emails.
DreamHost, the American web host and domain registrar, has now confirmed a data breach incident. Attackers broke into the server behind the tool customers use to manage website files. They had access for about two months before the company caught them on Friday, October 23.
How the Attack Happened
DreamHost offers a browser-based file manager known as File Manager at files.dreamhost.com. Customers use it to upload and edit website files. The system is based on third-party software, and the hacker took advantage of the vulnerability in this software.
Consequently, the hacker gained access to FTP and SFTP login details of all those who use the File Manager. People use these logins to send files to a website. The window ran from roughly August 2026 to October 23.
DreamHost has not named the software. It also has not explained why it missed the intrusion for so long. A spokesperson declined to say, citing the investigation, according to Teiss.
The attacker also reached some webmail systems. That gave the intruder login details for a limited number of webmail users. In a small number of cases, DreamHost believes the intruder used them to view mailbox contents. The company is contacting those customers one by one. DreamHost calls the attack deliberate.
Customers first noticed trouble on October 23. File Manager went down, and some webmail users lost their sign-ins. Then DreamHost reset email and FTP passwords. The affected customers were unable to log into their accounts unless the account owner set a new login.
For several days, the company gave no cause. Meanwhile, it pushed a fix, and File Manager came back online on October 26. On October 29, DreamHost posted a full explanation. Formal breach notices followed days later. Those letters carry the credit monitoring offer.
The Impact of the Attack
DreamHost puts the number well under 10% of its hosted email and FTP/SFTP accounts. However, that figure counts accounts, not customers. The company has not given an exact total. Data exposure incidents can affect businesses and their customers in different ways, as seen in the Success.com data leak that exposed over 207,000 subscriber records.
DreamHost reportedly serves about 400,000 customers. Still, the company says fewer customers appear affected than it first feared. Some people got reset notices as a precaution only.
There is one simple test. If an old email or FTP password still works and you never changed it, DreamHost says that password stays safe. Even so, it urges a change.
According to DreamHost, there is no evidence that the hacker accessed login details or billing information from the control panels. The company does not keep any credit card details on its servers – the payments are made by a third-party processor. The company also says PHP server updates played no role.
What DreamHost is Doing About the Incident
After the discovery, DreamHost took the File Manager server offline and saved it for forensic work. Then it rebuilt the tool with extra safeguards and closer monitoring. It also changed internal credentials that may have leaked.
In addition, the company hired outside security experts. It is checking its other customer tools for similar flaws. It is also notifying regulators.
For affected people, DreamHost offers one year of credit monitoring and identity theft protection through Equifax. It also suggests a fraud alert or a security freeze on your credit report.
Not DreamHost’s First Breach
In January 2012, hackers got into one of its database servers. Following this, the company reset all the FTP and shell passwords for all its approximately 300,000 customers. Back then, it said billing and personal data stayed safe.
For now, the investigation continues. DreamHost promises updates if anything significant turns up.
What You Should Do Now
First, find out if this affects you. Look for a notice from DreamHost. In addition, verify whether there is a user from your account who has lost their login rights from October 23. If you’re not sure, reach out to DreamHost support for help.
Next, reset the passwords. Only the account owner can do this in the DreamHost control panel. Type panel.dreamhost.com into your browser yourself. Do not click links in unexpected messages. New passwords can take up to 15 minutes to work.
After that, take these steps:
- Update saved passwords in your email and file transfer apps.
- Scan your website files for changes you do not recognize.
- Check for webmail forwarding and filtering rules that you did not create yourself.
- If you’ve reused the same password or a similar one on other accounts, now is time to change it.
Also, expect scams. DreamHost warns that breaches often bring copycat emails. It says it never emails to ask for your password. Its incident emails never ask you to sign in through a link.
Finally, think about your own clients. If you store their data on DreamHost, you may want legal advice about your duties.
