Ing. Calogero Bono
DreamHost, a well-known American hosting provider and domain registrar, has confirmed a data breach that hit its web-based File Manager. According to the notice sent to customers, attackers got in by exploiting a vulnerability and stole FTP/SFTP usernames and passwords, along with session data from some webmail accounts. The unauthorized access ran from August 2026 until October 23, 2026, the day it was discovered. It matters because anyone running a site on shared hosting relies on these tools for their files, their email and their work.
A few terms before we get into the facts. FTP/SFTP are the protocols used to upload and download a site's files to and from the server. File Manager is the browser tool that lets you manage those same files. Webmail is email read through the browser. A session token is the piece of data that keeps a user logged in after signing in, and if it is stolen it lets someone get in as that user. BEC (Business Email Compromise) is the scam in which a criminal uses a genuine mailbox to deceive customers and suppliers.
What happened at DreamHost?
In the notice to customers, cited by BleepingComputer, the company explains that an unauthorized third party gained access to the server that runs the File Manager at files.dreamhost.com. The intruder exploited a software vulnerability.
According to the same notice, the attackers were able to read the FTP/SFTP usernames and passwords of people who used that File Manager between August 2026 and October 23, 2026. In addition, for a «limited number» of webmail users, session information was exposed, credentials included.
DreamHost describes the attack as deliberate and says its staff worked nonstop to contain it.
How many customers are involved?
There is no precise figure. According to TechCrunch, a spokesperson said affected customers were «well under 10%», without giving a more exact number. The company reports around 400,000 paying customers, so the math is ours, but that would mean fewer than 40,000 customers.
The same spokesperson did not explain why the attack was only discovered now, citing the ongoing investigation. BleepingComputer says it contacted DreamHost several times about the number of accounts, without a response.
TechCrunch adds that the breach caused an outage lasting several days, during which some passwords were reset.
Are payments and the control panel safe?
For now DreamHost says it has no evidence that control panel access data or billing data were reached. According to TechRadar, the company does not store full card numbers, only a secure token, which cannot be used for purchases elsewhere.
According to BleepingComputer, payment data is handled by an external provider. These are the company's statements, and the investigation is still open.
What should affected customers do?
DreamHost has closed the active sessions of potentially affected users and invalidated their passwords. It offers one year of credit monitoring and identity theft protection through Equifax, and suggests considering a fraud alert or a freeze on the credit report.
According to BleepingComputer, anyone who receives the notice should check whether site files have been changed without authorization, review forwarding rules and filters in their webmail, and change passwords on other services where they used the same credentials. On password reuse, the same applies as in this article on the mSecure breach.
Limits to know
The vulnerability is not described, and DreamHost does not say why the attack stayed hidden for months. The exact number of affected accounts, the identity of the attackers and any ransom demand are unknown. The investigation is ongoing and the company has promised updates. TechRadar reports that no group has claimed the attack and that the data does not appear to have surfaced on the dark web, but the situation could change.
What changes for anyone working digitally
If you host a site on shared hosting, treat your files and email as potentially exposed, even if you have not been notified. A compromised mailbox can be used for spam, phishing and BEC scams, which also affects the reputation of your domain, as we explain in SPF, DKIM, DMARC and sender reputation. Check your site files, forwarding rules and who has FTP access. Also remember who holds what on your domain, as the guide on domain, hosting and email illustrates.
Our take
This case shows how much communication matters. A breach that lasted from August until October 23, discovered only at the end, and a spokesperson who does not explain why, leave real doubts about internal controls. The one positive note is that payment data seems separate from the rest, but that is a statement from the company, not a verification. A web File Manager with credentials that users must keep is a convenience that becomes a target. For anyone with customer data on the server, using unique credentials and limiting access channels is not excessive caution.
Frequently asked questions
When did the DreamHost breach happen?
Between August 2026 and October 23, 2026, the day DreamHost says it discovered the access. The company has not explained why it was only detected then.
What data was stolen?
FTP/SFTP usernames and passwords of people who used the File Manager, and session data, credentials included, of a limited number of webmail users. According to the company, the control panel and billing data have not been reached so far.
How many customers are affected?
The exact number is not known. A spokesperson said «well under 10%» of roughly 400,000 paying customers, without further details.
What does DreamHost offer affected customers?
One year of credit monitoring and identity theft protection through Equifax. It has also closed active sessions and reset the passwords of potentially involved users.
What should I check if I have a site on DreamHost?
Check whether your site files show suspicious changes, review forwarding rules and filters in your webmail, and change any passwords you reused elsewhere. Do this even if you did not receive the notice.
DreamHost's updates and the signals to watch in the coming weeks
The investigation is still open and key details are missing. It is worth following what the company says and what may emerge outside.
- Follow DreamHost's updates on the vulnerability, the number of accounts and the length of the access.
- Keep an eye out for reports of data appearing online or phishing campaigns that mention the provider.
- Ask your host how it logs and reports unusual access and how quickly it notifies customers.
