DreamHost Confirms Data Breach – Hackers Stole Customer Credentials and Accessed Emails

DreamHost has confirmed a breach that exposed customer login details after hackers exploited its web-based File Manager. The hosting provider said attackers obtained FTP/SFTP usernames and passwords, along with some webmail credentials. In a small number of cases, private mailbox contents may also have been viewed.

The company discovered unauthorized access on October 23, 2026. Its investigation identified a potential exposure window stretching back to approximately August. Customers who used File Manager during that period have been told to treat their file transfer credentials as compromised, even while investigators continue checking the full impact.

DreamHost currently estimates that well under approximately 10% of its hosted email and FTP/SFTP accounts were affected. That figure refers to accounts, not a confirmed number of individual customers. Some users received precautionary password reset notices but may not have had their credentials exposed.

The confirmation follows DreamHost’s earlier email and FTP password resets, which initially left the cause unclear. Those resets stopped affected users from signing in until account owners created new passwords. File Manager returned online on October 26, according to the earlier incident reporting.

DreamHost found no evidence that attackers accessed control panel logins or customer billing details. It also said full payment card numbers are not stored on its systems because an outside processor handles card payments. These findings remain subject to the ongoing investigation rather than proving that every possible risk has been excluded.

DreamHost Confirms Data Breach

In its October 29 security incident disclosure, DreamHost said the entry point was a flaw in third-party software behind File Manager. The browser-based tool lets customers manage website files. The notice does not name the software, describe the vulnerability, or provide a CVE identifier.

Attackers also reached certain webmail systems and obtained credentials belonging to a limited number of users. DreamHost reset those passwords and ended active sessions on October 23. It is contacting customers individually where investigators believe mailbox contents may have been viewed. The company has not confirmed widespread email theft.

Ending sessions matters alongside changing passwords. Separate reporting on stolen browser cookies and account takeovers explains how an authenticated session can expose email without another login. However, DreamHost’s public announcement does not explicitly confirm stolen session tokens, so that detail should not be treated as established by this notice.

DreamHost took the affected File Manager server offline and preserved it for forensic work. It then rebuilt the service with added safeguards and monitoring, changed potentially exposed internal credentials, and brought in outside security experts. Reviews of other customer-facing tools and required regulator notifications are also underway.

Affected users need their account owner to reset passwords through DreamHost’s control panel. The company recommends unique passwords, changing reused credentials elsewhere, and updating saved passwords in email and file transfer clients. Customers should inspect website files for unexpected changes and check mailbox forwarding rules and filters for unfamiliar entries.

Customers should type panel.dreamhost.com directly into their browser rather than follow login links in unexpected messages. DreamHost says its incident emails never request passwords or ask recipients to sign in through a link.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.