Hackers steal DreamHost customer files and emails in months-long breach
What's the story
DreamHost, a leading American web hosting and domain registration company, has confirmed a major data breach. The incident saw unauthorized access to its File Manager platform for two months, compromising customers' FTP/SFTP usernames and passwords. The company had earlier warned about a cybersecurity incident that required users to reset their email and FTP/SFTP passwords.
Incident timeline
Breach lasted 2 months
The data breach, according to DreamHost's notification, lasted from August 2026 until October 23, when it was discovered.
An unauthorized third party exploited a vulnerability in the software running their web-based File Manager at files.dreamhost.com.
This allowed them to access FTP/SFTP usernames and passwords of users who logged into this platform during the specified period.
Information
Company believes that the attack was deliberate
Along with FTP/SFTP credentials, the attacker may have also accessed DreamHost's webmail systems. This could have exposed session information, including credentials, for a limited number of users. The company believes that the attack was deliberate and has been working tirelessly to completely contain it.
Security measures
No evidence of access to payment details
So far, DreamHost has not found any evidence that the attacker accessed control panel login information or customer billing/payment details.
The company has blocked the attacker's access and patched the vulnerability exploited in this incident.
It has also terminated active sessions for potentially affected users and reset passwords as a precautionary measure against further unauthorized access.
User support
One year of credit monitoring offered to impacted individuals
To mitigate the risks from this exposure, DreamHost is offering impacted individuals one year of credit monitoring and identity theft protection through Equifax.
The company has also advised recipients of its notifications to check website files for unauthorized changes, review webmail forwarding rules and filters, and change passwords on other accounts where they may be using the same credentials.