Short answer
DreamHost said it discovered on 23 October 2026 that an unauthorized third party had accessed the server running its web File Manager through a flaw in third-party software. The attacker obtained FTP and SFTP credentials and some webmail logins. DreamHost says control panel logins and billing details were not accessed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | DreamHost |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Web hosting and domain registration |
| Country | United States |
| Detected | 2026-10-23 |
| Disclosed | 2026-10-29 |
| People or records affected | Well under about 10% of email and FTP/SFTP accounts, per DreamHost; no exact number given |
What data was exposed
- FTP and SFTP usernames and passwords of people who logged in to File Manager between about August 2026 and 23 October 2026
- Webmail login credentials for a limited number of users
- Mailbox contents, which DreamHost believes were viewed in a small number of cases
What happened
DreamHost, a US web hosting and domain provider, says it found on the afternoon of Friday 23 October 2026 that an unauthorized third party had accessed the server that runs its web-based File Manager. According to the company’s notice, dated 29 October, the attacker exploited a vulnerability in third-party software on that server. DreamHost has not named the software.
What was taken
The attacker obtained the FTP and SFTP usernames and passwords of people who logged in to File Manager before the intrusion was detected. DreamHost says exposure runs from about August 2026 to 23 October. The attacker also reached some webmail systems and obtained login credentials for a limited number of webmail users. In a small number of cases DreamHost believes the attacker may have viewed mailbox contents, and it says it is contacting those customers one by one.
DreamHost says it has no evidence that control panel logins or billing details were accessed. BleepingComputer, reporting on 4 November, noted that the company did not answer its questions about how many accounts were hit. The notice says well under about 10% of email and FTP/SFTP accounts were affected.
Response
The affected File Manager server was taken out of service and kept for forensic work. File Manager was rebuilt with added security and monitoring before returning online. Internal credentials were rotated and the vulnerability was fixed. DreamHost says it has retained outside security and forensics experts and is notifying regulators. It also states the incident was not related to recent PHP server updates.
As a precaution, DreamHost signed some email users out and invalidated their passwords. If an old password still works and you have not changed it, the company says its investigation shows it was not exposed, though changing it is still advised.
What account holders need to do
Only the account holder can reset mail, FTP and SFTP passwords, from the control panel. Changes can take up to 15 minutes. After that, update any saved passwords in mail apps and FTP clients, or those apps will keep failing.
The risk is greater than a lost login. An attacker with FTP access can alter website files, and one with webmail access can add forwarding rules to quietly copy your email. DreamHost’s advice to check both is worth following even if you were not locked out.
Watch for fake reset notices
DreamHost says it will never email you asking for your password, and that its incident emails never ask you to sign in through a link. A breach with forced resets is a good cover for phishing. Our guide to phishing messages covers how to spot them, and our data breach checklist covers what to do if you reused a password. If a stranger emails you about a hijacked site, see tech support scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails that copy DreamHost's reset notice and ask you to sign in through a link. DreamHost says its incident emails never ask you to sign in through a link.
- Account takeover of websites and mailboxes using the stolen credentials, then fraud emails sent from a legitimate address.
- Credential stuffing on other services if you reused the same password.
What to do if you are affected
- 01Sign in by typing panel.dreamhost.com yourself and reset the password of every mail, FTP and SFTP user on your account, since only the account holder can do this.
- 02Update saved passwords in your email, FTP and SFTP clients after the reset.
- 03Check your website files for changes you did not make and review webmail forwarding rules and filters for ones you did not set up.
- 04Change the same password anywhere else you used it, and use a unique password for each service.
- 05If you hold your own customers' data on DreamHost, ask your legal adviser whether you have notification duties.
Frequently asked questions
Was my DreamHost control panel password stolen?
DreamHost says it has no evidence that control panel logins or customer billing details were accessed. It does not store full card numbers, which a third-party processor handles. It still recommends strong, unique passwords.
How do I know if I am affected?
DreamHost says you may be affected if you or an FTP or SFTP user on your account logged in to File Manager between about August 2026 and 23 October 2026, or if an email user was signed out and the old password stopped working on or after 23 October.
How many accounts were hit?
DreamHost says well under about 10% of email and FTP/SFTP accounts. BleepingComputer asked several times for an exact number and reported no answer.
Is DreamHost offering credit monitoring?
BleepingComputer reported that DreamHost offered one year of credit monitoring and identity theft protection through Equifax. The notice page we read does not mention it, so check your own account email for the offer.
Sources
- October security incident, DreamHost, 2026-10-29
- DreamHost confirms data breach exposed FTP logins and webmail sessions, BleepingComputer, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.