DreamHost data breach: hackers stole FTP logins and emails, here’s what to do
DreamHost says hackers were inside its File Manager system from August to October 2026, stealing FTP logins, session tokens and some webmail access. Here's what was taken and what customers should do.
Web hosting company DreamHost has confirmed that hackers were inside one of its systems for about two months before being caught. The attackers stole FTP/SFTP logins, session tokens and some webmail logins, and in a small number of cases they may have read customers’ emails. DreamHost says “well under 10%” of its customers were affected. If you host a website or email with DreamHost, here’s what happened and what to do right now.
What happened?
According to TechCrunch and DreamHost’s notice to California’s attorney general, as reported by SQ Magazine and Tech Insider:
- The attack began around August 2026 (the start date is approximate).
- DreamHost detected it on October 23, 2026, and it was reported publicly around November 4.
- The attackers got in through a weakness in third-party software behind DreamHost’s web-based File Manager, the tool customers use to manage website files in a browser. DreamHost hasn’t named the software or the flaw.
“Please treat those usernames and passwords as compromised.” DreamHost
What was stolen?
- FTP/SFTP usernames and passwords of customers who logged into File Manager during the attack
- Session tokens, which can let someone act as a logged-in user, sometimes even after a password change
- Webmail login details for a limited number of users
- In a small number of cases, attackers may have viewed mailbox contents
DreamHost says it found no evidence that attackers reached control panel logins or billing details.
How many customers were affected?
DreamHost says “well under 10%” of its customers were affected, but hasn’t given an exact number. According to SQ Magazine, the company has roughly 400,000 paying customers, though that figure comes from secondary reports. It’s also not known how many mailboxes were actually viewed.
What DreamHost has done
- Blocked the attackers and fixed the flaw they used
- Reset affected passwords
- Rebuilt File Manager with extra monitoring
- Rotated internal credentials that may have been exposed
- Started reviewing its other customer tools
Formal notices to customers and regulators are still being prepared.
What DreamHost customers should do now
- Set new FTP, SFTP and email passwords in the DreamHost control panel. Only the account owner can do this, and changes can take up to 15 minutes to apply.
- Update saved passwords in your FTP app (like FileZilla), email app and any deploy tools.
- Change reused passwords. If you used the same password anywhere else, change it there too, starting with banking, email and cloud accounts.
- Check your website files for changes you didn’t make, such as unknown PHP files, hidden scripts or injected code. Compare with a backup or your Git history.
- Check your email settings for forwarding rules or filters you didn’t create, and look in Sent items for messages you didn’t send.
- Turn on two-factor authentication, ideally with an authenticator app. Our 2FA guide explains how.
- Use SSH keys instead of passwords for file access where possible.
- Watch for fake breach emails. DreamHost says its emails never ask for passwords or include sign-in links. Type panel.dreamhost.com into your browser yourself.
For a quick general plan, see our 10-minute checklist for what to do after a data breach.
Web hosting is a growing target
This is the second hosting-related security problem we’ve covered this week. Hackers also pushed a malicious update through the cPGuard hosting security tool, affecting about 2,950 Linux servers. Read our article on the compromised cPGuard update. Hosting companies hold the keys to thousands of websites and inboxes, which makes them valuable targets.
What it means for website owners
Even if you don’t use DreamHost, this is a good reminder:
- Never reuse your hosting password anywhere else.
- Keep regular backups of your website files and database, stored away from your host.
- Use version control like Git, so you can spot unexpected file changes quickly.
- Turn on 2FA for your hosting, domain registrar and email accounts.
Frequently asked questions
Was my DreamHost account hacked?
DreamHost says well under 10% of customers were affected, mainly those who logged into its web File Manager during the attack. Affected customers’ passwords were reset. If you’re unsure, change your FTP, SFTP and email passwords anyway.
Were credit card details stolen in the DreamHost breach?
DreamHost says it found no evidence that billing details or control panel logins were accessed.
How did hackers get into DreamHost?
They exploited a weakness in third-party software behind DreamHost’s web-based File Manager. DreamHost hasn’t named the software or the specific flaw.
How long were the hackers inside DreamHost?
The attack began around August 2026 and was detected on October 23, 2026, so roughly two months.
