Security notice

Site or email on DreamHost? It confirms a breach. Set new passwords and check your files today.

What happened

• How it started. On the afternoon of October 23, DreamHost said its operations team was investigating connection problems with the File Manager, the file tool in its control panel. A few hours later it described an incident affecting several services: File Manager (files.dreamhost.com) was offline, and some webmail users had been signed out or saw errors when logging in. (DreamHost status)
• Passwords reset "as a precaution." That evening DreamHost said the issue also affected FTP/SFTP access and webmail, and that "as a precaution, we are resetting passwords for some email and FTP/SFTP users." On October 24 it said the reset was complete and began emailing affected account owners in batches. By the evening of October 25 it said all affected account holders had been emailed. (DreamHost status)
• Affected users are locked out until the owner acts. DreamHost says these users "will be unable to log in until the owner of their DreamHost account resets their passwords and shares the new credentials with them." It cannot contact individual mailbox or FTP users directly, so account owners need to tell them. DreamHost says mail accounts keep receiving mail and FTP/SFTP user data stays on the server. (DreamHost status, DreamHost Knowledge Base, SecurityWeek)
• File Manager is back, the incident is not closed. On October 26, DreamHost said it pushed out a fix and files.dreamhost.com was back online, that it is monitoring to make sure File Manager is fully working, and that password resets are still required for a subset of email and FTP/SFTP accounts. When we checked its status page at about 8:15 AM ET on October 27, the incident was still open, the latest update was that one from October 26, and File Manager, email hosting and webmail were still listed as "Service Disruption." (DreamHost status, Help Net Security)
• DreamHost confirms a breach. In its October 29 post, DreamHost says the File Manager at files.dreamhost.com is "built on third-party software," that an unauthorized third party "exploited a vulnerability in that software," and that it "was able to access the FTP/SFTP usernames and passwords of users who logged into this File Manager before the activity was detected on October 23, 2026." It says this "was a deliberate attack." DreamHost has not named the software or the vulnerability, and a spokesperson did not tell TechCrunch what it was. (DreamHost incident post, TechCrunch)
• When. DreamHost says the affected logins are those used in File Manager "between approximately August 2026 and October 23, 2026." Its breach notice on the California Attorney General's site, reported there on November 2, lists the breach date as August 15, 2026. DreamHost has not said why it did not detect the attack sooner, and it declined to tell TechCrunch. (DreamHost incident post, DreamHost breach letter, TechCrunch)
• Webmail. DreamHost says the attacker "was also able to reach certain webmail systems and obtain the login credentials of a limited number of webmail users," that it reset those passwords and ended active sessions the same day, and that "in a small number of cases" it believes the attacker "may have used those credentials to view mailbox contents." It says it is contacting those customers individually. Its breach letter describes this as possible exposure of "session information," meaning the data that keeps a user signed in, which TechCrunch calls session tokens. (DreamHost incident post, DreamHost breach letter, TechCrunch)
• Files and email contents. DreamHost's breach letter says "the contents of your email and files in the FTP/SFTP server may have also been accessed." TechCrunch's headline says hackers "stole" customer files and inboxes, but DreamHost's own post and letter say may have been accessed or viewed, not taken, and we found no statement from DreamHost that files were copied. (DreamHost breach letter, DreamHost incident post, TechCrunch)
• What DreamHost says was not affected. DreamHost says it found "no evidence" that the attacker accessed control panel logins or customer billing details, that it "does not store full payment card numbers," and that card payments go through a third-party processor. Its websites and email stayed online throughout, it says. (DreamHost incident post, DreamHost breach letter)
• How many. DreamHost says the incident "affected a fraction of email and FTP/SFTP accounts hosted at DreamHost, well under approximately 10%," and that fewer customers are known to be affected than it first thought, so not everyone who got its first email was affected. It has not given a number, and BleepingComputer says DreamHost did not answer its questions about the count. (DreamHost incident post, TechCrunch, BleepingComputer)
• What DreamHost has done. It says it took File Manager offline, fixed the vulnerability, rebuilt and relaunched File Manager with more monitoring, rotated internal credentials that may have been exposed, reset affected passwords, ended sessions, brought in outside forensics experts and is reviewing its other customer tools. (DreamHost incident post)
• Breach letters. DreamHost's notice letter, filed with the California Attorney General, offers affected people one year of identity theft protection through Equifax at no cost, and explains fraud alerts and security freezes on credit reports. (DreamHost breach letter, BleepingComputer)
• Not linked to the PHP flaws. Some customers had speculated online that the incident was linked to the recent PHP flaws. DreamHost says it "was not related to recent PHP server updates" and that its PHP servers were patched within hours. Before it confirmed the breach, DreamHost's notice told account owners to check email forwarding, which BleepingComputer said at the time "suggests that some email accounts may have been breached." DreamHost has since confirmed webmail logins were obtained (see above). (DreamHost incident post, BleepingComputer)

Who should worry

• Your website, business email or FTP/SFTP logins are hosted with DreamHost.
• You are the DreamHost account owner and received an email about password resets, or someone on your team, a client or a family member could not sign in to email or FTP.
• A developer or agency uploads files to your site over FTP or SFTP.
• You, a developer or anyone on your account used DreamHost's File Manager (files.dreamhost.com) between about August 2026 and October 23, 2026.
• You are not sure who hosts your site or email. Ask.

An email password can open an inbox, and inboxes often hold password reset links for other services. An FTP or SFTP login can change the files your website serves. DreamHost now says FTP/SFTP logins used in File Manager were exposed, so setting new ones is necessary, not just a precaution. DreamHost says it will not email you asking for your password, and it asks everyone to go directly to its panel. (DreamHost status)

What to do now

Do these today.

1. Ask the question. Send the message below to your developer, agency or whoever runs your site and email. You need a clear answer: is any of it on DreamHost?
2. Treat File Manager logins as compromised. If you or any FTP/SFTP user on your account logged in to File Manager between about August 2026 and October 23, DreamHost says to "treat those usernames and passwords as compromised." Set new passwords for those users in the panel, even if a password still works. (DreamHost incident post)
3. Account owners: set new passwords in the panel. Type panel.dreamhost.com into your browser yourself. For email users, go to Mail > Manage Email. For FTP/SFTP users, go to Websites > SFTP Users & Files. DreamHost says you do not need to wait for its email, a new password can take up to 15 minutes to work, and you should use a strong, different password for each user. (DreamHost status, DreamHost Knowledge Base)
4. Tell the people who use those accounts. DreamHost says to reach them by phone, secure text or another private channel, not their DreamHost-hosted email, because they cannot open their inbox until they have the new password. Update any email app or FTP program that has the old password saved. (DreamHost Knowledge Base)
5. Check webmail forwarding rules and filters. DreamHost says to check your webmail settings, "especially forwarding rules and filters, for anything you didn't set up yourself," and to remove any forward you do not recognize. (DreamHost incident post, DreamHost Knowledge Base)
6. Change reused passwords elsewhere. DreamHost tells account owners that if a user reused the old password anywhere else, they should change it there too. (SecurityWeek)
7. If you or your developer use FTP or SFTP, check your site files. Look for files you do not recognize and changes you did not make, and compare against a recent backup if you have one. DreamHost now says to "look over your website files for any changes you don't recognize," and its breach letter says files in FTP/SFTP accounts may have been accessed. It has not said that any site files were changed. If your files hold your own customers' data, DreamHost suggests asking your own legal advisor whether you have obligations of your own. (DreamHost incident post, DreamHost breach letter)
8. Ignore reset emails you did not ask for. DreamHost says it will never email you asking for your password, its notice will not ask you to log in through a link, and a password reset email you did not request can be ignored. DreamHost now warns that incidents like this "are often followed by scam emails that imitate the companies involved," that its incident emails will never ask you to sign in through a link, and that you should type panel.dreamhost.com into your browser yourself. (DreamHost status, DreamHost incident post)
9. If you get DreamHost's breach letter, it offers one year of identity theft protection from Equifax at no cost. It suggests a fraud alert or a credit freeze mainly if the same password was used for a financial account, or if your email or files hold information that could open one. (DreamHost breach letter)

What to send your developer, agency or host

DreamHost has confirmed a breach. On October 29, 2026, it said an attacker exploited a vulnerability in the third-party software behind its File Manager (files.dreamhost.com) and accessed the FTP/SFTP usernames and passwords of users who logged in to File Manager between about August 2026 and October 23, 2026, plus the login credentials of a limited number of webmail users. DreamHost asks that those logins be treated as compromised, and says it found no evidence of access to control panel logins or billing details. Please confirm whether any of our website, email or FTP/SFTP logins are on DreamHost and whether anyone used File Manager in that period. If so, please set new, unique passwords for every email and FTP/SFTP user from the DreamHost panel, update saved passwords in email and FTP programs, check our site files for changes we did not make, check webmail forwarding rules and filters, change any reused passwords elsewhere, and tell us what you find. Sources: DreamHost incident post, DreamHost breach letter.

Common questions

Sources

• DreamHost: DreamHost Status, Investigating an incident affecting File Manager and Webmail, updates from October 23 to October 26, 2026, checked October 27, 2026, about 8:15 AM ET
• DreamHost: Current Status Notifications (Knowledge Base), October 25, 2026, article updated October 26, 2026
• BleepingComputer: DreamHost forces password resets in ongoing incident, October 26, 2026
• SecurityWeek: Unexplained DreamHost Incident Prompts Email, FTP Password Resets, October 27, 2026
• Help Net Security: DreamHost incident triggers password resets, locks customers out of email and FTP accounts, October 27, 2026
• DreamHost: October Security Incident, October 29, 2026, checked November 4, 2026
• DreamHost: Notice of Data Breach letter, filed with the California Attorney General, reported November 2, 2026, checked November 4, 2026
• BleepingComputer: DreamHost confirms data breach exposed FTP logins and webmail sessions, checked November 4, 2026
• TechCrunch: Hackers stole DreamHost customer files and inboxes during months-long attack, November 4, 2026, checked November 4, 2026