DreamHost Data Breach: A File Manager Flaw Exposed FTP and SFTP Passwords and Webmail Sessions, What Is Confirmed and What to Do This Week

DreamHost says an attacker broke into its web-based File Manager and collected the FTP and SFTP passwords of everyone who logged into it between about August 2026 and October 23, 2026, along with session data for some webmail users. If your business website or email is hosted at DreamHost, treat those logins as stolen: an FTP password lets someone quietly change your website's files, and a webmail session can let them read and redirect your email.

What happened in the DreamHost data breach

On the afternoon of Friday, October 23, 2026, DreamHost found that an unauthorized party had accessed the server that runs its web-based File Manager at files.dreamhost.com. In its October 29 announcement, the company says the attacker exploited a vulnerability in third-party software on that server, and it calls the incident a deliberate attack. DreamHost took the File Manager servers offline, blocked the access, addressed the vulnerability, ended active sessions for users who may have been affected and reset their passwords.

DreamHost's formal breach notice was filed with the California Attorney General, which lists it as reported on November 2, 2026, with a breach date of August 15, 2026. The letter says the attacker could see the FTP/SFTP usernames and passwords of people who logged into File Manager during that window. It also says the attacker reached certain webmail systems and may have exposed session information, the data that keeps a user signed in, for a limited number of webmail users.

Who is affected by the DreamHost breach

According to DreamHost, you may be affected if you or any FTP/SFTP user on your account logged into File Manager between about August 2026 and October 23, 2026. That includes web designers, developers and agencies you gave FTP access to. DreamHost says those credentials should be treated as compromised.

On October 29, DreamHost estimated that well under about 10% of email and FTP/SFTP accounts were affected. If you were signed out on or after October 23 and your old email password stopped working, DreamHost says that was a precaution, and you need to set a new password.

What is confirmed and what is not known

Confirmed by DreamHost:

• An attacker accessed the File Manager server by exploiting a vulnerability in third-party software.
• FTP/SFTP usernames and passwords of File Manager users in that window were exposed.
• Some webmail users' credentials were obtained, and some mailbox contents may have been viewed. DreamHost says it is contacting those customers one by one.
• The notice letter adds that email contents and files on the FTP/SFTP server may also have been accessed.
• DreamHost has found no evidence that control panel logins or billing details were accessed. It does not store full card numbers.
• People who receive the notice are offered one year of free identity theft protection through Equifax.
• DreamHost says the incident was not related to its recent PHP server updates.

Not known, because DreamHost has not said publicly:

• Which third-party software was affected, or which vulnerability was used.
• The exact number of affected accounts.
• Who carried out the attack.
• Whether the stolen passwords were used to change any customer websites.

DreamHost says its investigation is ongoing and that it has brought in outside forensics experts.

Why a stolen FTP password matters for a business website

FTP and SFTP access means write access to your website. Someone holding those credentials can upload files, edit pages, hide a backdoor that survives a password change, add a card-skimming script to a checkout page, or host phishing pages on your domain. Search engines and email providers may then flag your domain, which hurts traffic and email delivery long after the cleanup. We covered why sites built on popular platforms attract this kind of attention in Why WordPress Is the Most Targeted Website Platform.

Changing the password closes the door, but it does not remove anything already planted. If the attacker used your login between August and October, the only way to know is to check your files.

A webmail session matters too. Someone reading a business mailbox can see invoices, contracts and password reset emails. They can also add a forwarding rule or filter that quietly copies or hides messages, which is a common setup for invoice fraud, where customers are told your bank details have changed.

What to do this week: DreamHost breach checklist

How to check if your website files were changed

• Sort your site's files by modified date and review anything changed since mid-August 2026 that nobody on your team changed.
• Look for PHP files inside image or upload folders, unfamiliar files in the site root, and edits to .htaccess or index files.
• On WordPress, check the list of admin users and plugins for anything you do not recognize.
• Compare your site against a backup from before August or against your code repository.
• View the source of key pages, especially checkout and login pages, for unfamiliar scripts.

Attackers can fake modification dates, so a clean-looking file list is not proof. If you find anything odd, restore from a known-good copy rather than deleting files one at a time.

DreamHost breach questions people are asking

Was my DreamHost control panel password stolen?

DreamHost says it has found no evidence that control panel logins were accessed. If you used the same password for FTP or email, change it anyway.

Were credit card numbers exposed in the DreamHost breach?

DreamHost says it found no evidence that billing details were accessed, and that it does not store full card numbers. A third-party processor handles them.

I never used File Manager. Am I affected?

The FTP/SFTP password exposure is tied to logging into File Manager during the window. Check whether a designer or developer on your account used it. Webmail exposure was separate, and DreamHost says it is contacting those users directly.

Why can't I log in to my DreamHost email?

DreamHost reset passwords for possibly affected accounts on or after October 23. Set a new password in the control panel and allow up to 15 minutes for it to take effect.

Is DreamHost File Manager safe to use now?

DreamHost says the exploited vulnerability has been addressed and that it has added security measures to prevent a repeat. It has not named the software or the flaw.

Should I sign up for the free credit monitoring?

It costs nothing for a year through Equifax. It is most useful if your mailbox or website files held financial or personal details.

The bigger lesson

Your hosting provider is part of your security, and you cannot patch their software for them. What you can control is everything around it: unique passwords for every FTP and email user, removing access nobody needs, backups you can restore from, and file monitoring that spots a change in hours instead of months. That is the same gap we wrote about in Who Is Patching the Software That Runs Your Business?.

Want a second pair of eyes on your hosting and website access? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: DreamHost: October security incident; DreamHost notice of data breach letter, filed with the California Attorney General.