DreamHost confirmed that attackers used its web-based File Manager to reach customer login details, and in a small number of cases they may also have viewed private mailbox contents. The hosting provider said the exposed data included FTP/SFTP usernames and passwords, plus some webmail credentials. It discovered the unauthorized access on October 23, 2026, and its investigation placed the possible exposure window back to approximately August.
What DreamHost found
DreamHost estimates that well under approximately 10% of its hosted email and FTP/SFTP accounts were affected. That figure refers to accounts rather than a confirmed count of individual customers. Some customers received precautionary password reset notices even though their credentials may not have been exposed. The company has also said it found no evidence that attackers reached control panel logins or customer billing details, and that full payment card numbers are not stored on its systems because an outside processor handles card payments.
Earlier reset actions
The breach confirmation followed earlier email and FTP password resets that initially came before the cause was clear. Those resets blocked affected users from signing in until the account owners created new passwords. File Manager returned online on October 26, according to the earlier incident reporting.
Webmail access and session concerns
DreamHost said attackers also reached certain webmail systems and obtained credentials belonging to a limited number of users. It reset those passwords and ended active sessions on October 23. The company is contacting customers individually in cases where investigators believe mailbox contents may have been viewed, and it has not confirmed widespread email theft. The notice also does not explicitly confirm stolen session tokens, so that detail remains unestablished by the announcement.
File Manager investigation and response
In its October 29 security incident disclosure, DreamHost said the entry point was a flaw in third-party software behind File Manager. The browser-based tool lets customers manage website files. The notice does not name the software, describe the vulnerability, or provide a CVE identifier. DreamHost took the affected File Manager server offline for forensic work, then rebuilt the service with added safeguards and monitoring. It also changed potentially exposed internal credentials, brought in outside security experts, and said reviews of other customer-facing tools and required regulator notifications are underway.
Customer guidance from the notice
Affected users need their account owner to reset passwords through DreamHost’s control panel. DreamHost recommends unique passwords, changing reused credentials elsewhere, and updating saved passwords in email and file transfer clients. It also tells customers to inspect website files for unexpected changes and check mailbox forwarding rules and filters for unfamiliar entries. Customers are told to type panel.dreamhost.com directly into their browser rather than follow login links in unexpected messages. DreamHost says its incident emails never request passwords or ask recipients to sign in through a link.
Licensed under CC BY-ND 4.0 International