The DreamHost data breach has exposed FTP, SFTP and webmail credentials following the exploitation of third-party File Manager software. DreamHost has also confirmed that mailbox contents may have been viewed in a small number of cases.
The hosting provider detected the intrusion on 23 October 2026, but a subsequent regulatory notice indicates that relevant access may date back to approximately August 2026. The incident affects customers who used DreamHost’s browser-based File Manager during that period, along with a limited number of webmail users.
How the DreamHost data breach happened
DreamHost’s File Manager is a browser-based service available at files.dreamhost.com. It allows customers to work with files stored on their hosting accounts without using a separate FTP or SFTP application.
According to DreamHost, an unauthorised third party exploited a vulnerability in the third-party software behind this service. The company has not disclosed the software’s name, the affected version or the precise vulnerability used by the attacker.
Exploiting the flaw gave the attacker access to the File Manager server and data associated with users who had authenticated through the service. This included FTP or SFTP usernames and passwords used to access hosted files.
The sample consumer notice filed with the California Attorney General says the relevant exposure period ran from approximately August 2026 until DreamHost detected the intrusion on 23 October 2026. Customers who logged into File Manager during this window should therefore consider their FTP or SFTP credentials exposed.
Access extended to webmail systems
The intrusion was not confined to the File Manager environment. DreamHost said the attacker was also able to reach certain webmail systems and obtain login credentials belonging to a limited number of webmail users.
DreamHost terminated active sessions and reset the affected webmail passwords on 23 October. However, the company believes that mailbox contents may have been viewed in a small number of cases and is notifying those customers individually.
The regulatory notice also warns that email contents and files stored on FTP or SFTP servers may have been accessed. This makes the DreamHost data breach more than a password exposure event, because information held inside mailboxes or hosted directories could also be involved.
DreamHost data breach timeline
The sequence of status updates, public reporting and formal notifications shows how the known scope developed after the initial service disruption.
-
Approximately August 2026: The potential exposure window begins for customers who logged into DreamHost File Manager, according to the regulatory notice.
-
23 October 2026: DreamHost detects unauthorised access to the File Manager server. It takes File Manager servers offline, starts password resets, ends affected webmail sessions and begins publishing status updates.
-
26 October 2026: Reports describe forced email and FTP or SFTP password resets. Customers are advised to inspect email forwarding rules, while status updates later report the restoration of File Manager.
-
29 October 2026: DreamHost publicly confirms the security incident, credential theft and possible access to mailbox contents in a small number of cases.
-
2 November 2026: DreamHost files a sample consumer notice with the California Attorney General. It identifies the approximate August to 23 October exposure window and describes potential access to email and hosted file contents.
Some coverage published on 26 and 27 October characterised the password resets as precautionary and said data theft had not been confirmed. Those reports reflected the information available at the time, but they were superseded by DreamHost’s 29 October announcement and the regulatory filing on 2 November.
Accounts, services and data affected
The clearest affected group is customers who authenticated through files.dreamhost.com between approximately August 2026 and 23 October 2026. Their FTP or SFTP usernames and passwords could have been obtained from the compromised server.
A separate, limited group of DreamHost webmail users had login credentials compromised. For a small number of these users, the attacker may also have viewed mailbox contents. DreamHost has not published the number of affected accounts in either category.
Data potentially at risk in the DreamHost data breach includes:
-
FTP or SFTP usernames and passwords associated with File Manager logins.
-
Webmail login credentials for a limited number of users.
-
Mailbox contents in a small number of cases.
-
Files stored on affected FTP or SFTP servers.
-
Session information associated with certain webmail systems.
DreamHost says it found no evidence that control panel login credentials or customer billing details were accessed. It also states that it does not store full payment card numbers, limiting the payment data risk identified so far.
Current exploitation status
This was confirmed in-the-wild exploitation rather than a theoretical vulnerability. DreamHost said the attacker successfully used the third-party software flaw to enter the File Manager environment and obtain credentials.
No threat actor has been named, and DreamHost has not published a proof of concept or detailed technical analysis. As of 3 November 2026, it has also not released indicators of compromise such as malicious IP addresses, domains or file hashes.
The absence of public indicators makes account records, access logs and unexpected configuration changes particularly important for identifying possible misuse. It does not mean that every customer account or every hosted file was accessed.
Why the DreamHost data breach matters
FTP and SFTP credentials can provide direct access to website files. If reused or still active, stolen credentials could enable an attacker to alter pages, upload malicious files, steal stored information or disrupt a hosted service.
Compromised webmail accounts create a different risk. Access to message history can expose confidential conversations, invoices, password reset links and personal data. Attackers may also create forwarding rules or filters to retain access to incoming messages after a password has been changed.
For UK organisations, any confirmed exposure of personal data in email or hosted files may require an assessment under UK GDPR. The decision should be based on the data involved, the likelihood of harm and the organisation’s notification obligations.
Actions for affected DreamHost customers
Organisations that used File Manager during the stated exposure window or operate DreamHost mailboxes should treat the incident as a potential credential compromise. DreamHost has already reset affected passwords, but customers should verify that replacement credentials are unique and properly controlled.
-
Change all relevant FTP, SFTP and webmail passwords, including reused credentials on other services.
-
Review webmail forwarding rules, filters, recovery settings and active sessions for unauthorised changes.
-
Inspect FTP, SFTP and website access logs for unfamiliar logins, file changes or uploads.
-
Check hosted directories and mailboxes for personal, financial or confidential information that may have been exposed.
-
Preserve relevant logs and document the assessment if the incident could involve reportable personal data.
Customers should also monitor DreamHost’s official notices for further technical details or individual notifications. The confirmed response has contained the known access route, but reviewing account activity remains necessary because the possible exposure period extended across several weeks.
Originally reported by Claim Depot.
