NewsCompaniesFlawsGuides
Get the app

DreamHost breach exposed file-transfer passwords; email and files may also have been accessed

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
dreamhost.com: October Security Incident - DreamHost
Screenshot: dreamhost.com

Attackers exploited DreamHost’s File Manager, exposing FTP/SFTP usernames and passwords over roughly two months. DreamHost says some webmail credentials were also obtained, and email and file contents may have been accessed. The company says it addressed the flaw, ended potentially affected sessions and reset passwords.

Attackers obtained passwords through DreamHost’s website File Manager, and email and file contents may also have been accessed. Affected customers should replace passwords and have their website manager check what was left behind.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If you or your website manager used DreamHost’s browser-based File Manager between approximately August and 23 October 2026, treat the passwords used there as compromised. Attackers exploited a flaw in the service to obtain FTP/SFTP usernames and passwords: the logins used to access website files.

DreamHost’s breach notice[1] says webmail sign-in information may also have been exposed. Email contents and files stored on affected accounts may have been accessed.

DreamHost File Manager breachWebsite files and webmail
HARD level
High
Exposure window
Approximately August–23 October 2026
Passwords involved
FTP/SFTP and some webmail logins
Other possible access
Email contents and hosted files
What’s known.DreamHost’s breach notice and public incident statement describe the exposure.

Timeline

  1. HARD publishes its article, at High.

Who is affected

Start by asking whoever manages your website whether they used DreamHost’s File Manager during that period. DreamHost says some customers received precautionary password-reset notices without ultimately being affected. It also says it believes a small number of mailboxes were viewed and is contacting those customers individually. Its public statement[2] reports no evidence of access to control-panel logins or customer billing details.

What DreamHost has fixed

DreamHost says it rebuilt File Manager and addressed the vulnerability. Its status log[3] records the service returning on 26 October and the disruption being resolved on 27 October. Affected users still needed new passwords. Restoring the service does not replace the checks customers have been asked to make.

What to do this week

  1. Have the account owner replace affected passwords.Type panel.dreamhost.com into your browser. Use Mail > Manage Email for email passwords[4], and Websites > SFTP Users & Files for file-access passwords[5]. Changing a WordPress login is a separate task.
  2. Ask your website manager to check files and mail settings.Look for unexpected website-file changes and unfamiliar email forwarding rules or filters. These are checks recommended in the breach coverage[6]. Report suspicious findings to DreamHost.
  3. Replace reused passwords elsewhere.DreamHost also recommends changing the same or similar passwords on other services. Consider what sensitive information was in affected email or files, and which other accounts need reviewing.
  4. Go directly to DreamHost for help.Its incident notices will not ask for your password or ask you to sign in through an email link. Contact support through your account if you cannot tell which users were affected.

References

  1. ^ DreamHost, via California Department of Justice. “Notice of Data Breach”. Formal notice establishes the approximate exposure window and possible email and file access.
  2. ^ DreamHost (). “October Security Incident”. Primary account of affected users, possible mailbox viewing, remediation and customer precautions.
  3. ^ DreamHost Status (). “Investigating an incident affecting File Manager and Webmail”. Dated recovery updates, password-reset instructions and warnings about email links.
  4. ^ DreamHost (). “Change password (Mail users)”. Documents email-password changes through Manage Email and account-owner assistance.
  5. ^ DreamHost (). “Change password (Website users)”. Documents file-access password changes and distinguishes them from WordPress logins.
  6. ^ BleepingComputer (). “DreamHost confirms data breach exposed FTP logins and webmail sessions”. Reports credential exposure, containment and recommended file and mailbox checks.
  7. TechCrunch (). “Hackers stole DreamHost customer files and inboxes during months-long attack”. Secondary reporting reviewed against primary notices.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.