DreamHost breach: FTP/SFTP and webmail passwords accessed through its File Manager, mailbox contents may have been viewed in a small number of cases
DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August 2026 and October 23, 2026, plus the webmail credentials of a limited number of users; formal breach notices filed with the California Attorney General were listed on November 2, 2026, and the company says the incident affected well under about 10% of its hosted email and FTP/SFTP accounts.
What happened
DreamHost, the web hosting company, said it discovered on the afternoon of Friday, October 23, 2026 that an unauthorised third party had accessed the server that runs its web-based File Manager at files.dreamhost.com. The attacker exploited a vulnerability in the File Manager software — a third-party tool customers use to work on their website files in a browser. DreamHost took the File Manager servers offline on discovery, addressed the vulnerability, reset the passwords of email and FTP/SFTP users whose credentials may have been exposed, and ended active sessions the same day. It published a public incident post on October 29, and formal breach notification letters followed: a sample letter filed with the California Attorney General was listed on November 2, 2026, and offers recipients one year of free identity theft protection services through Equifax. DreamHost says its investigation is ongoing and that fewer customers are now known to be affected than originally suspected; it has not given a total count of affected people.
Who is affected
DreamHost customers who logged into the web-based File Manager between approximately August 2026 and October 23, 2026: the attacker was able to access those users’ FTP/SFTP usernames and passwords, which DreamHost says should be treated as compromised. The attacker was also able to reach certain webmail systems and obtain the login credentials of a limited number of webmail users, and in a small number of cases may have used those credentials to view mailbox contents — DreamHost says it is contacting those customers individually. The California filing lists the information involved as usernames, passwords, email contents and files stored on the FTP/SFTP server. DreamHost says the incident affected a fraction of the email and FTP/SFTP accounts it hosts, well under approximately 10%, and that it found no evidence the attacker accessed control panel logins or customer billing details; it does not store full payment card numbers.
How serious
The concrete risk is account takeover of the things those credentials unlock. FTP/SFTP passwords give direct access to a website’s files, which an attacker can use to change the site, plant malicious code on it, or read files and databases stored there. A webmail password can hand over the mailbox itself — and because email is the reset channel for most other accounts, a taken mailbox can cascade into further takeovers. Any password that was reused on another service should be considered exposed as well. DreamHost has already reset the affected passwords on its own systems, which closes the direct route back in, but it cannot reset a reused password anywhere else.
What to do now
If you are a DreamHost customer, have the account holder set new passwords from inside the DreamHost control panel at panel.dreamhost.com — type the address yourself; DreamHost says it will never email you asking for your password, and its incident emails never ask you to sign in through a link. Update any email, FTP or SFTP clients that still hold the old passwords. Check your webmail settings, especially forwarding rules and filters, for anything you did not set up, and look over your website files for changes you do not recognise. Change every other account where you reused a DreamHost email, FTP or SFTP password, and if you received the formal notice letter, use the free Equifax identity theft protection it offers.
Sources: DreamHost, “October Security Incident”, published October 29, 2026 · Dapeer Law summary of DreamHost’s notice letter filed with the California Attorney General (listed November 2, 2026), November 3, 2026