What Happened in the DreamHost Data Breach
The DreamHost Data Breach is the kind of incident that sounds small at first and gets worse the longer you look at it. Hackers were inside one of DreamHost’s systems for about two months before anyone noticed. They did not just peek at a server and leave. They collected login details that could open customer websites and, in some cases, read private emails. TechCrunch reported the full story on 4 November 2026, a few days after DreamHost posted its own notice on 29 October 2026. By then, many customers had already lived through days of outages and forced password resets without knowing the full reason why.
DreamHost is a large web host, with about 400,000 paying customers, so even a small percentage of affected accounts can mean tens of thousands of people. The company says the share hit was well under approximately 10 percent of its email and FTP/SFTP accounts. It has not given an exact number. That gap matters, because customers are left to work out for themselves whether they were caught up in it. If you host a site or an email inbox with DreamHost, this is worth ten minutes of your time, even if you never received a warning email.
This article explains what happened, what was taken, who is most likely affected, and what to do now. It sticks to what DreamHost has said in its own notice and what TechCrunch reported from the breach notice filed with California’s attorney general. Where the two accounts differ, that is pointed out, because the details are still moving and the investigation is ongoing.
How the Attack Worked
According to DreamHost, an unauthorised third party exploited a vulnerability in third-party software behind its web-based File Manager, the tool at files.dreamhost.com that customers use to work on their website files from a browser. The company has not named the software or the flaw, and no CVE identifier has been published. That is frustrating for security researchers, but it is also common while an investigation is still open.
DreamHost found the problem on the afternoon of Friday 23 October 2026. It took the File Manager servers offline the same day, fixed the vulnerability, and started an investigation. The affected File Manager server was taken out of service and preserved for forensic work. DreamHost says it has since rebuilt File Manager with extra security precautions and enhanced monitoring before bringing it back online. Reports say File Manager returned on 26 October 2026, after several days of disruption.
The breach notice filed with California’s attorney general says the attack began in August 2026. That means the intruder had roughly two months of quiet access before discovery. TechCrunch also reported that the attackers obtained session tokens, the small pieces of data that keep a user signed in after entering a password. A stolen session token can let an intruder act as that user without typing the password again. DreamHost’s own public notice does not mention session tokens, so that detail comes from the TechCrunch report and the filing it describes.
DreamHost has described the attack as deliberate, and it says it has brought in outside legal advisers and security and forensics experts. It is also notifying regulators as required by law. What it has not explained is why the intrusion went undetected for about two months. When TechCrunch asked, a spokesperson declined to answer, citing the ongoing investigation.
What Was Stolen
The main thing the attacker got was login credentials. Anyone who logged in to File Manager before 23 October 2026 may have had their FTP and SFTP usernames and passwords captured. That is serious on its own. FTP and SFTP credentials are the keys to a website. With them, an attacker can upload files, change pages, plant malicious code, or download a site’s contents. If you reuse the same password in more than one place, the risk spreads further, which is why DreamHost is telling affected users to treat those credentials as compromised.
The attacker also reached certain webmail systems and obtained login credentials for a limited number of webmail users. In a small number of cases, DreamHost believes those credentials were used to view mailbox contents. The company says it is contacting those customers individually. It reset the passwords of affected webmail users and ended their active sessions on the day it found the break-in.
There is some better news, and it is worth stating plainly. DreamHost says its investigation so far has found no evidence that the attacker accessed control panel logins or customer billing details. It also says it does not store full card numbers, because payments go through a third-party processor. That does not prove nothing else was touched, and the company itself says the investigation is ongoing, but it does draw a line between what is confirmed and what is not. The same notice stresses that this incident was not related to recent PHP server updates, a point DreamHost made because some customers had linked the two events.
Who Is Affected
You may be affected if you, or an FTP or SFTP user on your account, logged in to File Manager between about August 2026 and 23 October 2026. That is the window DreamHost gives in its notice. The company says a fraction of email and FTP/SFTP accounts were hit, well under approximately 10 percent. With about 400,000 paying customers, even a small fraction could still be a large number of accounts, so do not assume you are safe just because the percentage sounds low.
Some customers received a password reset email during the outage in late October, before the full notice was published. DreamHost now says its ongoing investigation suggests that not everyone who received that first email was actually affected, and that fewer customers are known to be affected than first suspected. That is reassuring, but it also means the first email is not a reliable test. The safer approach is to act as if your File Manager era credentials were exposed if you used the tool in that window, and to change them.
Affected customers are being offered one year of free credit monitoring and identity theft protection through Equifax, according to the sample notice filed with the regulator. If you received a notice with that offer, take it. It costs you nothing and it gives you an early warning if your details turn up elsewhere. If you did not receive a notice, check your DreamHost account messages and your email spam folder before deciding you were not involved.
What DreamHost Customers Should Do Now
Start with passwords, and do not put this off. Change every FTP and SFTP password for accounts that were used through File Manager between August and 23 October 2026. Use a fresh, unique password for each one, and do not reuse a password from your email or your DreamHost panel. A password manager makes this far easier, and it removes the temptation to recycle one familiar password across accounts. If you manage sites for clients, change their FTP credentials too, and tell them what happened in plain language.
Next, change your webmail password if you use DreamHost email, especially if you received a reset notice or if you logged in to webmail during the exposure window. Then check your email settings for anything you did not set yourself. Look for forwarding rules that send your mail to an unknown address, and check your sent folder for messages you did not send. Attackers who get into an inbox often set up quiet forwarding so they can keep reading mail after the password is changed, and that is easy to miss if you only change the password and move on.
Check your websites as well. Look at recently changed files, new admin users, and any unfamiliar plugins or scripts. If you have backups from before August 2026, keep them somewhere safe while you check. If a site was changed without your knowledge, restore from a clean backup and change every credential connected to that site, not just the FTP login. Small business owners should also check whether any contact forms or customer data pass through the affected accounts, and keep a note of what they find.
Turn on two-factor authentication for your DreamHost panel and your email if you have not already. It is the single most useful step after a password change, because a stolen password alone is no longer enough to get in. If your team shares logins, give each person their own account instead, and remove old FTP users who no longer need access. Old accounts are easy entry points, and this breach is a good reason to clean them up. For a wider look at protecting your accounts online, see our guide to the best VPNs in 2026, which also covers practical steps for safer browsing and logins.
What DreamHost Has Done So Far
DreamHost took File Manager offline on 23 October 2026, fixed the vulnerability, and reset the passwords of email and FTP/SFTP users whose credentials may have been exposed. It ended active sessions for affected webmail users the same day. It has rotated exposed internal credentials, rebuilt File Manager with additional security and monitoring, and kept outside forensics experts on the investigation. It is notifying regulators and affected customers, and it says formal notices will follow where required.
That response is solid as far as it goes, but two questions are still open. The first is the exact number of affected accounts. DreamHost has only said well under approximately 10 percent, and its spokesperson would not give TechCrunch a more precise figure. The second is why detection took about two months. Until DreamHost answers that, customers cannot judge whether the same kind of slow detection could happen again. Breaches of this shape are not new, and the pattern will look familiar to anyone who followed our earlier coverage of the DigiCert data breach, where stolen credentials also sat at the centre of the story.
The lesson for customers is not to wait for a perfect answer. Change the passwords, check the inboxes and the sites, turn on two-factor authentication, and keep an eye on your accounts for the next few weeks. DreamHost may update its notice as the investigation continues, so check its security page again if you want the latest position. The facts in this article come from DreamHost’s October Security Incident notice and the TechCrunch report of 4 November 2026.
Frequently Asked Questions
When did the DreamHost Data Breach happen? The attack began in August 2026, according to the breach notice filed with California’s attorney general. DreamHost discovered it on the afternoon of Friday 23 October 2026 and published its notice on 29 October 2026.
What was stolen in the DreamHost Data Breach? FTP and SFTP usernames and passwords for users who logged in to File Manager before 23 October 2026, plus login credentials for a limited number of webmail users. In a small number of cases, mailbox contents may have been viewed. TechCrunch also reported that session tokens were obtained.
Was my billing information or credit card exposed? DreamHost says it has found no evidence that control panel logins or billing details were accessed. It says it does not store full card numbers, because payments are handled by a third-party processor.
How many customers were affected? DreamHost says well under approximately 10 percent of its email and FTP/SFTP accounts were affected, out of about 400,000 paying customers. It has not given an exact number.
I received a password reset email. Does that mean I was hacked? Not necessarily. DreamHost says not everyone who received the first email was affected. Treat it as a warning to change your passwords and check your accounts, rather than proof of a compromise.
What should I do first if I used File Manager? Change your FTP and SFTP passwords, change your webmail password, check for unknown email forwarding rules, turn on two-factor authentication, and review your websites for unfamiliar files or users.
Is File Manager safe to use now? DreamHost says it rebuilt File Manager with extra security and monitoring before bringing it back online on 26 October 2026. Use it with fresh credentials and two-factor authentication, and keep your passwords unique.
Sources
Verified against DreamHost, October Security Incident, 29 October 2026 and TechCrunch, Hackers stole DreamHost customer files and inboxes during months-long attack, 4 November 2026.