DreamHost says intruders took FTP passwords and some webmail logins over about two months

DreamHost is a large U.S. web host and domain registrar. If you have a website, a blog or an email address on a custom domain, there’s a fair chance it runs on a host like DreamHost, and maybe on DreamHost itself. On October 23, 2026, the company found that someone had broken into the server behind its browser-based File Manager. It now says the intruder had been there since about August, and that FTP passwords, some webmail logins and possibly some files and emails were reached. Here’s what DreamHost has said, and what to do if you have an account there.

What happened

According to DreamHost’s announcement, posted October 29, and the notice letter it filed with California’s attorney general on November 2:

• About August 2026: an attacker began exploiting a vulnerability in the File Manager at files.dreamhost.com, a browser tool built on third-party software that customers use to work on the files behind their websites. The California filing gives August 15 as the start date.
• August to October 23: anyone who signed in to File Manager in that period had their FTP or SFTP username and password exposed. The attacker also reached some webmail systems and got the login credentials or session information of “a limited number” of webmail users. A session is what keeps you signed in after you type your password, so a stolen one can work like a password.
• October 23: DreamHost discovered the access, took the File Manager servers offline, fixed the vulnerability and reset the passwords of email and FTP/SFTP users it thought might be affected. It ended their active sessions the same day.
• October 29: it published the announcement and said fewer customers were affected than it first thought.
• November 2: it filed a sample of its formal notice letter with California’s attorney general, and said it is notifying regulators in other places as required. BleepingComputer and TechCrunch reported on them on November 4.

DreamHost hasn’t named the vulnerability or the third-party software. It told TechCrunch the attack was unrelated to the recent PHP vulnerabilities, and its announcement says its PHP servers were patched within hours.

What was reached, and what wasn’t

The notice letter says the data accessed “may have included” the username and password used for File Manager or webmail, and that “the contents of your email and files in the FTP/SFTP server may have also been accessed.” The announcement is a little narrower: in “a small number of cases,” DreamHost believes the attacker may have used stolen webmail credentials to view mailbox contents, and it is contacting those customers one by one.

DreamHost says it has found no evidence that control panel logins or billing details were accessed. It doesn’t store full card numbers; a third-party processor handles card payments.

Who is affected

DreamHost says the incident affected “well under approximately 10%” of the email and FTP/SFTP accounts it hosts. A spokesperson told TechCrunch the number of affected customers is “well under 10%” but wouldn’t give an exact figure. DreamHost has some 400,000 paying customers, TechCrunch notes.

According to the announcement, you may be affected if:

• you, or an FTP/SFTP user on your account, signed in to File Manager between about August 2026 and October 23, 2026, or
• an email user on your account was signed out and the old password stopped working on or after October 23. That was DreamHost resetting it.

If you didn’t get an email from DreamHost about this, the company says no action is needed, though changing passwords is still a reasonable precaution. People who get a formal notice are offered one year of credit monitoring and identity theft protection through Equifax.

Why it matters

An FTP password opens the files behind a website. With it, someone can quietly add a malicious script, a phishing page or a hidden redirect to a site that visitors trust, and the owner may not notice for weeks. A webmail login or session is often worth even more, because email is where password reset links arrive. One of the oldest tricks after a mailbox break-in is to add a forwarding rule or filter, so copies of your mail keep going to the attacker even after you change your password. That’s why DreamHost’s advice focuses on checking files and mail settings, not only on new passwords.

This is the second hosting story on Frame this week. On November 4 we covered how a hijacked cPGuard update stole root secrets from about 2,950 web hosting servers. The two incidents aren’t connected, but both show that the tools sitting next to your website can be the way in.

What you can do

If you have a DreamHost account:

1. Set new, unique passwords for every mail and FTP/SFTP user on the account. Only the account holder can do this, from the control panel. Type panel.dreamhost.com into your browser rather than following a link.
2. Update saved passwords in your email apps, FTP clients and any deploy tools so they don’t keep failing or locking you out.
3. Look over your website files for anything you don’t recognize: new files, changed theme or plugin files, or unfamiliar code near the top or bottom of pages.
4. Check your webmail settings, especially forwarding rules and filters, and remove anything you didn’t set up.
5. Change the same password anywhere else you used it. If that password protected a bank or another important account, also watch those accounts closely.
6. Think about what was in your mailbox or files. If they held logins, ID scans or customer data, change those logins and, if you run a business, check whether you have your own duties to tell anyone. DreamHost suggests talking to your own legal adviser about that.
7. Ignore emails asking you to sign in through a link. DreamHost says it will never ask for your password by email, and its incident emails won’t ask you to sign in through a link.

If you use a different host, this is still a good moment to check your mail forwarding rules and switch from FTP to SFTP or SSH keys where your host offers them.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake “reset your hosting password” email sent to the wrong address is easy to spot. Frame never collects or stores the leaked records themselves.

Related coverage

• A hijacked cPGuard update stole root secrets from about 2,950 web hosting servers: another hosting-side incident this week, through a security tool’s update channel.
• How infostealers steal your sessions, and why a new password isn’t enough: why a stolen session can matter as much as a stolen password.

Sources

• DreamHost, October Security Incident, October 29, 2026
• DreamHost, Notice of Data Breach (sample letter filed with the California Attorney General, PDF), November 2, 2026
• California Attorney General, DreamHost, LLC breach notification listing, November 2, 2026
• TechCrunch, Hackers stole DreamHost customer files and inboxes during months-long attack, November 4, 2026
• BleepingComputer, DreamHost confirms data breach exposed FTP logins and webmail sessions, November 4, 2026