DreamHost has confirmed that hackers accessed customer emails, login credentials, and files during a cyberattack that spanned several months. The hosting provider revealed the breach in early November, after discovering the intrusion triggered a major service outage and forced widespread password resets.
What Happened
The company’s browser-based File Manager—used to manage website files—was compromised via a vulnerability in third-party software. Attackers exploited this flaw to gain access to the File Manager server at files.dreamhost.com, which then allowed them to harvest FTP/SFTP usernames and passwords of users who logged in during the affected period. Certain webmail systems were also breached, enabling the theft of login credentials and, in some cases, content.
The unauthorized access is believed to have occurred from mid-August 2026 through October 23, 2026. It was only on October 23 that DreamHost discovered the intrusion, took File Manager servers offline, addressed the software vulnerability, and began resetting credentials.
Scope and Implications
DreamHost estimates the breach affected “well under 10%” of its roughly 400,000 paying customers—a figure that could represent tens of thousands of accounts. The company has not published a more precise number. Although email contents were accessed in a limited number of cases, no evidence suggests that control panel logins or payment card data were compromised.
In response, DreamHost terminated all active sessions for affected users, reset passwords for email and FTP/SFTP accounts, and sent notices to customers whose credentials may have been exposed. Users are also being encouraged to inspect their site files for unauthorized changes and check email forwarding rules or filters that might have been manipulated during the breach.
What’s Not Yet Known
Details about the specific vulnerability—such as the name of the third-party software or version number—and the full extent of the data accessed remain undisclosed. DreamHost has stated the flaw is unrelated to recent PHP vulnerabilities, but hasn’t clarified how this intrusion went undetected for months. Ongoing investigations aim to flesh out these gaps.
DreamHost claims no evidence to date that billing data or control panel credentials were breached. Its payment processing works through an external third-party, and full payment card numbers are not stored on DreamHost’s systems.
Why It Matters
This breach underscores how even toolsets meant for customer convenience—like browser-based file managers—can present critical risk vectors if dependencies or third-party components are vulnerable. Tools with elevated access can expose more than just user files; they become gateways to email systems, session data, and other sensitive assets.
The delayed detection also raises questions about visibility and threat monitoring. For hosting providers especially, logging session token use, monitoring third-party software updates, and ensuring quick patch and response workflows are essential for preventing long dwell times.
As customers of DreamHost and similar services evaluate risk, they should assume that credentials used during the exposure period may have been compromised. Resetting passwords, enforcing multi-factor authentication where possible, tracking unusual login activity, and reviewing any suspicious forwarding rules or site changes are all crucial countermeasures.
