DreamHost Security Review After October 2026 File Manager Breach Exposing FTP Credentials

DreamHost security review shows that the October 2026 File Manager breach exposed FTP and SFTP login details for a small portion of users. The hosting provider discovered the unauthorized access on October 23 and took the tool offline the same day. Password resets followed quickly for impacted accounts.

DreamHost Security Review: Timeline and Scope of the Breach

The exposure window ran from approximately August 15, 2026, until detection on October 23. Attackers gained entry through a vulnerability in third-party software that powered the web-based File Manager at files.dreamhost.com. DreamHost removed the tool immediately, terminated active sessions, and restored the service on October 26 after adding monitoring and fixes.

Data at risk included FTP and SFTP usernames and passwords for anyone who logged into File Manager during that period. A smaller number of webmail accounts also had login details and, in limited cases, possible mailbox access. Control panel credentials and billing information showed no signs of compromise, and the company does not store complete payment card numbers. The affected share of accounts stayed well below 10 percent of DreamHost’s roughly 400,000 paying customers.

Public notice came on October 29, followed by a filing with the California Attorney General around November 2. The company retained external forensics specialists and described the incident as a deliberate attack. Formal customer notifications began rolling out, with some recipients offered 12 months of credit monitoring and identity theft protection.

Actions Taken and Recommended User Steps

DreamHost reset passwords for potentially exposed accounts by October 24 and continues to investigate with outside experts. The company has stated it will send additional regulatory updates and customer notices as the review progresses. No specific CVE identifier or detailed vulnerability information has been released yet.

Users whose email passwords stopped working after October 23 should reset them through the control panel at panel.dreamhost.com. The same applies to SFTP users listed under Websites > SFTP Users & Files. Everyone should audit website files for unauthorized changes and restore from backups dated before August 15 if needed. Checking webmail forwarding rules and filters also helps detect any lingering issues.

• Choose a strong, unique password for every account and update FTP clients and email applications.
• Enable two-factor authentication where available in the DreamHost panel.
• Monitor account activity and report unexpected logins directly through the support portal.
• Ignore any email that claims to come from DreamHost and asks for login details.

DreamHost has not asked customers to verify credentials by email and will not do so in the future. Ongoing security reviews of other internal tools remain in progress as of November 5, 2026.

Comparison of Exposed and Protected Data

The breach affected only specific access methods tied to the File Manager. The table below summarizes the categories involved.

Customers who did not use the File Manager during the exposure window face lower risk, though password changes remain advisable for any account that may have shared credentials elsewhere. Regular audits of FTP and email access logs provide an added layer of protection going forward.