DreamHost has confirmed a security incident involving its browser-based File Manager after an unauthorized third party exploited a vulnerability in the tool and accessed FTP/SFTP usernames and passwords tied to customers who used it between approximately August 2026 and October 23, 2026.
DreamHost said the vulnerability was in third-party software used by File Manager at files.dreamhost.com.
The company also said the unauthorized party reached certain webmail systems and obtained login credentials for a limited number of webmail users. A U.S. breach notice sample posted by the California Attorney General adds that webmail session information, including session credentials that keep users signed in, may have been exposed. DreamHost said that, in a small number of cases, it believes the attacker may have used credentials to view mailbox contents and that those customers are being contacted individually.
DreamHost says it has found no evidence so far that control panel logins or customer billing details were accessed. It says full payment card numbers are not stored by the company and that card payments are handled by a third-party payment processor. It also said the incident was not related to recent PHP server updates.
Timeline from public notices
August 15, 2026: The California Attorney General’s breach portal lists this as the known breach date. DreamHost’s notice describes the access window as between August 2026 and October 23, 2026.
October 23, 2026: DreamHost said it discovered the unauthorized access, took File Manager offline, addressed the vulnerability, and began resetting passwords for affected email and FTP/SFTP users.
October 24 to 25, 2026: DreamHost’s status page said password resets for affected users had been completed and that instructions were being sent to affected account owners in batches.
October 26, 2026: DreamHost said engineers had pushed out a fix and brought File Manager back online for monitoring.
October 27, 2026: The company marked the File Manager and webmail incident as resolved, while noting that password resets were still required for a subset of email and FTP/SFTP user accounts.
October 29, 2026: DreamHost published its public incident announcement.
Who may be affected
DreamHost says its current analysis indicates the incident affected a fraction of email and FTP/SFTP accounts hosted at DreamHost, well under 10%. The company has not released a final number of affected accounts or users.
Potentially affected users include FTP/SFTP users who logged into File Manager between approximately August 2026 and October 23, 2026, and email users whose old passwords stopped working on or after October 23 because DreamHost reset them during the investigation. DreamHost also said not everyone who received its initial email was ultimately affected.
DreamHost says customers who did not receive an email about the issue do not need to take action at this time, although the company points to precautionary steps for anyone who wants to be cautious.
Checks affected account owners should make
DreamHost’s recommended response goes beyond setting a new password. Because the incident involved file access and webmail systems, affected account owners should review both website and email activity.
Reset affected mail, FTP, and SFTP passwords from the DreamHost control panel. DreamHost says only the account holder can set new passwords, and a changed password may take as long as 15 minutes to work.
Update saved passwords in email, FTP, and SFTP clients. Old credentials in mail apps, FTP software, deployment tools, or mobile devices will fail after the reset.
Change reused credentials elsewhere. Any same or similar password used on another service should be treated as exposed.
Review website files. Account owners should look for files, scripts, redirects, timestamps, or changes that cannot be explained.
Check webmail settings. Forwarding rules and filters should be reviewed, especially rules sending mail to outside addresses.
Watch for phishing. DreamHost says its incident emails do not ask for passwords and do not ask users to sign in through a link.
The U.S. breach notice sample says DreamHost arranged one year of Equifax identity theft protection services for affected recipients. Users outside the United States should rely on the notice sent directly to them, since DreamHost said it would send formal notices under the laws of affected users’ countries.
Businesses should assess stored customer data separately
DreamHost advised customers who use its services to store information about their own customers, clients, or users to consult legal advisors about possible additional obligations. The breach notice says contents of email and files in the FTP/SFTP server may also have been accessed.
For site operators, the practical follow-up is to determine what data was inside affected mailboxes and file areas before closing the incident internally. That review may include form submissions, invoices, customer records, private documents, backups, configuration files, access keys, or credentials stored in website directories or email.
The investigation and unanswered questions
As of November 6, 2026, DreamHost has not publicly named the specific third-party File Manager software, disclosed the exact vulnerability, confirmed a final account count, or said how much data was accessed. TechCrunch reported that a DreamHost spokesperson declined to say why the attack was not detected until October 23, citing the ongoing investigation.
DreamHost says it preserved the affected File Manager server for forensic investigation, rebuilt File Manager with additional security precautions and enhanced monitoring, rotated internal credentials that may have been exposed, retained outside security and forensics experts, and is reviewing other customer-facing tools for similar vulnerabilities.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
