DreamHost, a well-known web hosting provider, has recently confirmed a security breach that has compromised customer login information. The attack targeted their web-based File Manager, allowing hackers to access FTP/SFTP usernames and passwords, as well as some webmail credentials. In a few instances, private email contents were also exposed.
Discovery and Scope of the Breach
The unauthorized access was detected by DreamHost on October 23, 2026, although the breach may have begun as far back as August. Customers who utilized the File Manager during this period are advised to consider their file transfer credentials compromised. The company continues to assess the full extent of the breach.
Current estimates suggest that under 10% of DreamHost’s hosted email and FTP/SFTP accounts were impacted. This percentage represents accounts rather than individual customers. Some users were advised to reset their passwords as a precaution, even if their credentials remained safe.
Immediate Actions and Investigation
Following the breach confirmation, DreamHost implemented password resets for email and FTP accounts, which temporarily restricted access until new passwords were set by account holders. The File Manager service was restored on October 26, after initial security measures were enacted.
DreamHost has not found evidence of unauthorized access to control panel logins or customer billing information. Payment card numbers are not stored on DreamHost systems, as transactions are processed by an external provider. The investigation is ongoing to ensure all risks are identified and addressed.
Security Measures and Customer Guidance
In a disclosure dated October 29, DreamHost attributed the breach to a flaw in third-party software used by File Manager. Although details of the software and vulnerability remain unspecified, DreamHost has reset passwords and ended sessions for affected webmail accounts, contacting customers directly when mailbox content exposure is suspected.
DreamHost has emphasized the importance of ending active sessions along with password changes to prevent account takeovers. The company has taken the compromised File Manager server offline for forensic analysis, rebuilt the service with enhanced security features, and engaged external security experts for further evaluations.
Customers are strongly encouraged to reset passwords via DreamHost’s control panel, use unique passwords, and update any reused credentials. Additionally, they should inspect their website files and email settings for unauthorized changes. For security reasons, users should access DreamHost’s control panel directly through their browser rather than clicking on links in unsolicited messages.
