DreamHost breach exposes FTP credentials for up to 10% of customers

This incident highlights the risk associated with third-party software vulnerabilities in web hosting environments.

DreamHost reports breach affecting up to 10% of customers

The American web hosting and domain registration provider, which offers services including managed WordPress hosting and cloud services, suffered a data breach that began in August 2026 ^{[2][6][7][11]}.

According to a company spokesperson, those affected represented “well under 10%” of DreamHost's approximately 400,000 paying customers ^[2]. The company first disclosed the incident publicly on October 29 ^[8][11].

Exploitation of File Manager and webmail systems

The breach occurred when attackers exploited a vulnerability in third-party software running the web-based File Manager at files.dreamhost.com ^[2][8][11]. This service allows customers to manage and store files via a browser without using separate FTP applications ^[6][11]. DreamHost stated that the flaw was unrelated to recently discovered vulnerabilities in PHP web software ^[2][8].

Attackers stole FTP and SFTP usernames and passwords belonging to individuals who logged into the File Manager during the exposure window ^[2][6][8]. Beyond the file system, the intruder reached certain webmail systems ^[2][6][11]. This access exposed session tokens—information that keeps users signed in after they enter a password—and credentials for a limited number of users ^[2][6].

DreamHost confirmed that private mailbox contents may have been viewed in a small number of cases ^[8][11]. According to a sample consumer notice filed with the California Attorney General on November 2, the breach also potentially exposed files stored on FTP/SFTP servers ^[7][11].

Containment efforts and information gaps

DreamHost took the affected File Manager server offline on October 23 to preserve it for forensic work ^[8]. The company restored the service on October 26 after rebuilding it with added safeguards and monitoring and changing potentially exposed internal credentials ^[8]. Outside security experts were brought in to assist, and the company is reviewing other customer-facing tools ^[8].

The company has not disclosed the name of the third-party software used for the File Manager, its version, or the specific CVE (Common Vulnerabilities and Exposures) identifier for the exploited vulnerability ^[8][11].

According to company notices, there is no evidence that the attackers accessed control panel login credentials or customer billing and payment information ^[2][6][8]. An external provider handles payment details, and DreamHost does not store full credit card numbers ^[8]. DreamHost noted that these findings remain subject to an ongoing investigation ^[8].

Remediation and support for affected users

DreamHost terminated active sessions and invalidated passwords for potentially affected users on October 23 ^[2][8]. The company is providing affected individuals with one year of credit monitoring and identity theft protection through Equifax Credit Watch Gold ^[2][6][7][8].

Affected users were urged to check their website files for unauthorized modifications and review webmail forwarding settings and filters ^[2][6]. DreamHost also advised customers to change any passwords reused on other accounts and to update saved passwords in their file transfer programs ^[6][8].

To avoid phishing, the company instructed customers to type the control panel address, panel.dreamhost.com, directly into their browser rather than clicking links in unexpected messages ^[8]. DreamHost stated its incident emails never ask for passwords or request that recipients sign in via a link ^[8]. Additionally, users were urged to consider a security freeze or fraud alert on their credit reports ^[6].

What we don't know

• What is the name and version of the third-party software that contained the vulnerability?
• Exactly how many individual accounts were compromised?
• Why did the intrusion go undetected for approximately two months? A company spokesperson declined to answer this, citing the ongoing investigation ^[8].