DreamHost has disclosed a cybersecurity breach that allowed unauthorized actors to harvest customer credentials and access private files over a two-month period. The intrusion, which targeted the hosting provider’s web-based File Manager, began on approximately August 15, 2026, and remained undetected until late October.
According to a formal notice filed with the California Attorney General’s office, the breach was discovered on October 23 after a service disruption prompted a security review. The investigation revealed that attackers exploited a vulnerability in the third-party software powering the company’s File Manager tool, located at files.dreamhost.com. While DreamHost has patched the vulnerability, the company has not publicly named the specific third-party software involved.
Scope of the Exposure
The primary target of the attack was the harvesting of credentials. Attackers were able to capture FTP and SFTP usernames and passwords for customers who logged into the File Manager during the ten-week exposure window. Additionally, webmail session information and login credentials were stolen for a subset of users.
In a notification to affected users, DreamHost confirmed that in a “small number of cases,” the unauthorized actors may have viewed private mailbox contents and files. However, the company emphasized that the breach did not affect all users. The incident impacted “well under 10%” of DreamHost’s approximately 400,000 customers.
Security researchers and the company’s internal teams confirmed that several critical systems remained untouched during the incident. Specifically:
- Customer billing details, including credit card numbers and payment history, were not accessed.
- Main DreamHost control panel login credentials were not compromised.
- The vulnerability was localized to the third-party File Manager software and was not related to recent general PHP security updates.
Response and Mitigation
DreamHost took the File Manager offline on October 23 to contain the threat and conduct a forensic investigation. The company has forced password resets for affected FTP, SFTP, and email accounts. While the breach is significant due to its duration, the containment to a specific third-party tool prevented a wider compromise of the hosting platform’s core infrastructure. More information regarding the timeline of the incident can be found through Class Action U, which tracks the legal filings associated with the event.
DreamHost has advised customers who used the File Manager between August and October to monitor their accounts for unauthorized changes and to ensure they are not reusing the compromised credentials on other platforms. The company stated it is continuing to work with law enforcement and external security experts to investigate the full extent of the attackers’ activities.
