DreamHost Breach: Hackers Spent Two Months Stealing Customer Files and Email Logins
Web host DreamHost has confirmed that hackers spent roughly two months inside its systems, quietly taking customer login details and reaching into some email accounts before anyone noticed. The company disclosed the incident in late October, and the full scale only became clear when TechCrunch reported on it on November 4, 2026.
DreamHost is a large US hosting provider with about 400,000 paying customers, and many of them run small business websites, blogs, and online stores on its servers. ## What happened
According to a breach notice DreamHost filed with the California attorney general, the attack began in August 2026. An unauthorized party got into the server that runs the company's browser-based File Manager, the tool at files.dreamhost.com that customers use to upload and edit files on their websites.
DreamHost says it discovered the intrusion on the afternoon of Friday, October 23, 2026. The company took the File Manager servers offline, fixed the flaw, and posted a public notice on October 29. The disclosure first surfaced publicly after a multi-day service outage the previous week, during which DreamHost reset some customer passwords.
The breach notice was formally listed by the California attorney general on November 2, 2026. DreamHost has also reported the incident to the attorneys general in Vermont and Washington, and a Washington filing lists 871 Washington residents as affected.
How the attackers got in
DreamHost says the attacker exploited a vulnerability in third-party software that powers its File Manager. The company has not named the software or described the exact flaw, and no CVE identifier has been published. It has said the flaw is unrelated to recent widely reported problems in PHP web software.
What was stolen
The notice says the attacker was able to capture the FTP and SFTP usernames and passwords of anyone who logged into the File Manager between approximately August 2026 and October 23, 2026. Those credentials control access to the files on a hosted website, so a stolen set could let an attacker change pages, plant malicious code, or read stored data.
The damage did not stop at file access. DreamHost says the intruder also reached certain webmail systems and obtained login credentials for a limited number of webmail users, and in a small number of cases mailbox contents may have been viewed. TechCrunch reported that the attackers also obtained session tokens, digital keys that keep users logged in without re-entering a password.
On the reassuring side, DreamHost says its investigation has found no evidence that attackers accessed control panel logins or customer billing and payment details. The company also says it does not store full payment card numbers, because an outside processor handles card payments. The investigation is still ongoing, so those statements could change.
How many customers are affected
DreamHost has not given an exact number of affected accounts. A spokesperson told TechCrunch that the number is "well under 10 percent" of customers, without giving a more precise figure. Against a base of about 400,000 paying customers, even a small percentage could mean tens of thousands of accounts.
What DreamHost has done, and what you should do
DreamHost says it ended the active sessions of users who may have been affected and reset their passwords. It is offering affected customers one year of free identity theft protection and credit monitoring through Equifax. The company has urged anyone who logged into the File Manager between August and October 23 to treat those credentials as compromised and change them, even if no notification letter has arrived yet.
Start by changing your FTP and SFTP passwords if you logged into the File Manager during the affected window, and do the same for any webmail password that could be involved. Do not reuse the old password anywhere else, and if you used the same password on other sites, change it there too.
Next, check your hosted files and your email for anything you do not recognize. Look for new files, changed pages, or redirects you did not set up, and check your webmail sent folder and filters for rules you did not create. Attackers who hold a mailbox often set up forwarding rules so they can keep reading mail after a password change.
Turn on two-factor authentication on your DreamHost panel if you have not already, and review which users and FTP accounts have access to your hosting. Remove any old FTP users you no longer need. If your site was touched, restoring from a clean backup made before August is safer than trying to clean files by hand.
Finally, go straight to panel.dreamhost.com by typing the address yourself rather than following a link in an email. Breach news always attracts phishing attempts, and a fake "reset your password" message is the most likely follow-up attack here. Two months passed between the start of the intrusion and its discovery, so waiting for a letter is the slow path. Acting now costs a few minutes, and it closes the window the attackers were using.
Post Comment