DreamHost Data Breach: FTP Passwords Stolen for Months. Here's What to Do

Your hosting login sat unlocked for months. Not the panel. The File Manager. And if you reused that FTP password anywhere else… yeah. Fix it today.

US web host DreamHost has confirmed a DreamHost data breach tied to its browser-based File Manager. Attackers got in around August 2026 and weren't caught until 23 October 2026. FTP/SFTP usernames and passwords for people who used File Manager in that window were exposed. A smaller set of webmail logins was hit too. If you run a site, a client site or a side project on DreamHost — US or UK — this one's for you.

TL;DR - Intrusion window: about August 2026 → 23 October 2026 (discovered that Friday afternoon). - Target: DreamHost's web File Manager at files.dreamhost.com (third-party software with a vulnerability). - Stolen: FTP/SFTP usernames + passwords for File Manager users in that window; some webmail credentials; mailbox contents viewed in a small number of cases. - No evidence control-panel logins or billing/payment details were accessed. - DreamHost says impact is a fraction of accounts, well under ~10%. Passwords were reset; File Manager was rebuilt. - Next risk: phishing that pretends to be DreamHost "support" or "password reset".

What Happened in the DreamHost Data Breach?

Per DreamHost's official October Security Incident post (updated through late October / early November notices), an unauthorised third party accessed the server running the web-based File Manager. That tool is how customers edit website files in a browser. It sits on third-party software. Attackers exploited a vulnerability in that software.

Once inside, they could grab FTP/SFTP usernames and passwords for anyone who logged into File Manager before the activity was detected on 23 October. They also reached certain webmail systems and obtained login credentials for a limited number of webmail users. DreamHost reset those passwords and killed active sessions the same day. In a small number of cases, DreamHost believes the attacker may have used those credentials to view mailbox contents — and says it is contacting those customers individually.

BleepingComputer and TechCrunch both covered the wider disclosure on 4 November 2026, including DreamHost's California attorney-general breach notices. DreamHost has not published an exact headcount of affected accounts. A spokesperson told TechCrunch the figure is "well under 10%," against a customer base DreamHost has touted around 400,000 paying customers.

What Wasn't Taken (According to DreamHost)

This part matters, because panic travels faster than facts:

• No evidence the attacker accessed DreamHost control-panel login information.
• No evidence customer billing details were accessed.
• DreamHost says it does not store full payment card numbers; card payments go through a third-party processor.
• The company says the incident was not related to recent PHP server updates; it says PHP servers were patched quickly and its WAF blocked large numbers of intrusion attempts around those patches.

So: this is a credential and mailbox-access story, not a "they stole every card on file" story. Still bad. Just different bad.

Who Is Affected?

DreamHost's own checklist is blunt. You may be affected if:

• You, or an FTP/SFTP user on your account, logged into File Manager between about August 2026 and 23 October 2026. Treat those usernames and passwords as compromised.
• An email user on your account was signed out and the old password stopped working on or after 23 October. That was DreamHost resetting mailboxes it believed could have been exposed.

If a previously working email/FTP/SFTP password still works and you did not change it yourself, DreamHost says its investigation so far indicates it was not exposed — though it still recommends changing it as a precaution. If you never got an incident email, DreamHost says no action is required right now, with the same "better safe" caveats.

What DreamHost Says It Did

• Took File Manager servers offline on discovery and addressed the vulnerability.
• Reset passwords for email and FTP/SFTP users whose credentials may have been exposed.
• Terminated active sessions for potentially affected users.
• Preserved the affected File Manager server for forensics, then rebuilt and relaunched File Manager with extra monitoring.
• Rotated internal credentials that may have been exposed.
• Brought in outside security and forensics help; investigation ongoing.
• Started notifying regulators and sending formal breach notices (including California AG filings reported by BleepingComputer and TechCrunch).
• Offered affected individuals one year of Equifax credit monitoring / identity theft protection in its US notice letters.

Why FTP Password Theft Hits Harder Than It Sounds

FTP/SFTP access is the keys to your website files. With those creds, an attacker can:

• Drop a phishing page or malware on your domain.
• Inject spam scripts that blast your visitors.
• Steal customer data your site stores in files or config.
• Plant a backdoor that survives a casual "I changed my panel password" cleanup.

Webmail access is the other nightmare fuel. Inbox access means password resets for other services, invoice fraud, and "hey boss, wire this" social engineering. That's why DreamHost's advice to check forwarding rules and filters is not optional fluff — silent redirects are a classic post-breach move.

Same energy as the follow-up scams we covered after the Amadeus airline data breach: the first hit steals context; the second hit pretends to be help.

What You Should Do Right Now (US & UK Checklist)

1. Reset from the real panel only. DreamHost says only the account holder can set new mail/FTP/SFTP passwords inside https://panel.dreamhost.com/. Type that URL yourself. Do not use a link from email or DMs.
2. Update every client that saved the old password — FileZilla, Cyberduck, Outlook, Apple Mail, phone apps, CI deploy keys, whatever.
3. Assume password reuse is dead. If that FTP or mailbox password lived anywhere else (GitHub, AWS, Stripe, Notion…), rotate those too.
4. Audit website files. Look for new PHP/JS files, weird .htaccess rules, unexpected cron jobs, or modified themes/plugins you did not touch.
5. Check webmail settings. Forwarding rules, filters, auto-responders, connected devices/sessions — remove anything you did not create.
6. Watch for phishing. DreamHost will never email asking for your password. Incident emails will not ask you to sign in through a random link. UK readers: forward scam texts to 7726 and scam emails to report@phishing.gov.uk. US readers: report at reportfraud.ftc.gov and use IdentityTheft.gov if you spot identity misuse.
7. If you store customer data on that host, talk to your lawyer or compliance person about notice duties. DreamHost says it will share info needed to support those obligations.

For a broader hardening pass, use our cybersecurity checklist for startups and the 2026 overview of AI cybersecurity threats businesses need to watch.

The Scam Wave Coming Next

DreamHost literally put a phishing warning in its incident post, because this movie always has a sequel:

• "Urgent: confirm your DreamHost password or your site goes offline."
• "Your FTP was compromised — click here to restore backups (pay a fee)."
• "Support needs your panel login to finish forensics."

None of that is how real remediation works. Real DreamHost password changes happen inside the control panel after you navigate there yourself. Slow down. Call or chat support from the panel. Don't gift the attacker round two.

The Bottom Line

The DreamHost File Manager breach is a reminder that "I only use FTP sometimes" is still enough. Credentials for a browser file tool sat exposed for roughly two months before discovery. Payment cards look safe so far. Your site files and some inboxes may not be. Reset, audit, unique passwords, and treat every "DreamHost support" message like it's lying until proven otherwise.

More explainers live in our cybersecurity section and the wider technology category.

FAQ

What happened in the DreamHost data breach?

An unauthorised party exploited a vulnerability in DreamHost's web-based File Manager at files.dreamhost.com. Access ran from about August 2026 until discovery on 23 October 2026, exposing FTP/SFTP usernames and passwords for users who logged into File Manager in that window, plus login credentials for a limited number of webmail users.

Were DreamHost payment or control-panel details stolen?

DreamHost says it has found no evidence that control-panel logins or customer billing details were accessed. Full payment card numbers are handled by a third-party processor and are not stored by DreamHost.

Who is affected by the DreamHost breach?

DreamHost says a fraction of email and FTP/SFTP accounts were affected, well under about 10% of accounts. You may be affected if you or an FTP/SFTP user on your account logged into File Manager between about August 2026 and 23 October 2026, or if DreamHost reset your mailbox password on or after that date.

What should DreamHost users do now?

Reset mail, FTP and SFTP passwords from the DreamHost control panel if prompted, use unique strong passwords, update saved clients, check website files for unknown changes, and review webmail forwarding rules and filters. Treat any reused passwords on other sites as compromised.

Will scammers email after the DreamHost breach?

Very likely. DreamHost warns that incidents like this are often followed by phishing that imitates the company. DreamHost will never email asking for your password, and password changes only happen inside panel.dreamhost.com typed by you, not via a random link.

Source: DreamHost — October Security Incident (official announcement). Also referenced: BleepingComputer (4 November 2026), TechCrunch (4 November 2026), and DreamHost's California AG breach notice. Facts as reported on 29 October – 4 November 2026.

Image credits

• Featured graphic: Factash original.
• Supporting image: BleepingComputer (downloaded and self-hosted; not hotlinked).