DreamHost Data Breach

DreamHost Data Breach Exposed FTP Passwords and Reached Webmail: What Website Owners and Email Users Need to Know

For up to about 10 weeks, an attacker had a path to the passwords people used to manage websites at DreamHost. DreamHost now says email contents and server files may also have been accessed.

DreamHost, LLC, a Los Angeles web hosting company and domain registrar, is sending Notice of Data Breach letters to customers. The company says an unauthorized third party exploited a vulnerability in its web-based File Manager at files.dreamhost.com. DreamHost calls the incident “a deliberate attack.”

How the DreamHost File Manager Attack Happened

The File Manager is a browser tool for working with website files. DreamHost says it is built on third-party software. According to the company, the attacker exploited a flaw in that software and reached the server behind it.

DreamHost says it discovered the unauthorized access on the afternoon of October 23, 2026. It took the File Manager offline and fixed the vulnerability. Its notice letter says the attacker could access the FTP and SFTP usernames and passwords of people who logged in to the File Manager between approximately August 2026 and October 23, 2026. FTP and SFTP are methods for moving files to and from a web server.

The California Attorney General listing gives a breach date of August 15, 2026, according to breach reporting reviewed by Emery | Reddy. If that date holds, the exposure window ran about 10 weeks before DreamHost detected it.

The attacker also reached certain webmail systems. The notice letter says this may have exposed session information for a limited number of webmail users. Session information is the data that keeps a user signed in. DreamHost’s October 29 announcement describes webmail login credentials and says that, in a small number of cases, the attacker may have used them to view mailbox contents.

Source: DreamHost announcement; BleepingComputer

Why Mailbox Users and Website Visitors May Not Hear From DreamHost

This breach reaches past the person who pays the DreamHost bill. Many small businesses host their website and company email at DreamHost. Their staff and their own customers may have data sitting in those mailboxes and files.

BleepingComputer reported on October 26 that DreamHost said it cannot contact individual mailbox or FTP users directly. Account owners must notify those users themselves. A person who uses a business email address hosted at DreamHost may therefore never receive a letter from DreamHost.

DreamHost’s own announcement tells customers who store data about their customers to consult legal advisors about any obligations they may have.

How Many People Were Affected?

DreamHost has not published a total. The company says the incident affected a fraction of email and FTP/SFTP accounts, “well under approximately 10%,” and that fewer customers were affected than it first suspected. The California filing does not give a count in the materials Emery | Reddy reviewed. BleepingComputer reported that DreamHost first blocked access for all users until they reset passwords, and DreamHost now says some resets were precautionary.

What Information Was Exposed?

Based on DreamHost’s notice letter, the information involved may include:

• Usernames and passwords used for the File Manager (FTP/SFTP)
• Webmail usernames, passwords or session information
• Contents of email
• Files stored on the FTP/SFTP server

DreamHost says it has found no evidence that the attacker accessed control panel logins or customer billing details. It also says it does not store full payment card numbers. The investigation is ongoing. Because mailboxes and server files can hold almost anything, the notice does not say what personal details those emails or files contained.

What Is DreamHost Offering Affected Customers?

The notice letter offers free identity theft protection services for one year through Equifax. Recipients enroll with the activation code in their letter at equifax.com/activate. DreamHost directs questions to dreamhost.com/support/#form, under the “Account security” topic. DreamHost notes it will never ask for a password by email.

Your Information Is at Risk

Stolen passwords often work beyond the site they came from. Criminals test them on banks, email and shopping accounts. Access to a website’s files also allows an attacker to plant malicious code or copy customer records. Access to a mailbox can expose password reset links, invoices and private messages.

Affected individuals should:

• Change any reused or similar passwords on other services
• Check email forwarding rules and filters for anything unfamiliar
• Review website files for changes they did not make
• Enroll in the offered protection before any deadline in the letter
• Watch for phishing messages that mention the incident
• Review credit reports and account statements

Do You Have Legal Options?

Companies that store login credentials, email and customer files have a legal obligation to safeguard them. When that obligation is not met, affected individuals may have legal rights and remedies. Emery | Reddy is investigating the DreamHost breach. No Fee Unless We Recover.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected by the DreamHost breach?

DreamHost has not released a total. It says the incident affected “well under approximately 10%” of email and FTP/SFTP accounts.

What information was exposed?

Your File Manager or webmail username and password or session information may be involved. Your email contents and files on the FTP/SFTP server may also have been accessed.

Was my credit card exposed?

DreamHost says it found no evidence the attacker accessed billing details and that it does not store full card numbers. Its investigation is still ongoing.

I use a business email hosted at DreamHost. Will I get a letter?

Maybe not. BleepingComputer reported that DreamHost said it cannot contact individual mailbox users directly. If you were locked out of your email around October 23, ask the owner of the account whether your mailbox was affected.

What should I do if I got a letter?

Take these steps:

• Save the letter
• Change reused passwords
• Enroll in the offered protection
• Contact Emery | Reddy for a Free Case Review

How can I protect myself from scams that mention this breach?

Do not click links in messages about the incident. Go directly to the company’s website. Never give a password by email, phone or text.

Do I have a legal claim?

You may. Companies have a duty to protect the data you trust them with and to tell you when it is exposed. If DreamHost notified you, or your mailbox was affected, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.