DreamHost confirms major breach of customer credentials

DreamHost discovers unauthorized access

Web hosting provider DreamHost discovered unauthorized third-party access to its File Manager server at files.DreamHost.com roughly two weeks before disclosure.

Attack happened in August 2026

DreamHost said the unauthorized access occurred during August 2026 when threat actors exploited a vulnerability in the File Manager software.

Hackers stole login credentials

The vulnerability gave attackers access to FTP and SFTP usernames and passwords of logged-in individuals, plus webmail session information from a limited number of users.

Stolen credentials enable serious attacks

Access to login credentials means attackers can read stored files and emails, and use compromised accounts to launch phishing attacks or Business Email Compromise attacks.

Payment data appears uncompromised

DreamHost found no evidence that attackers accessed control panel login information or customer billing details. The company does not store full payment card numbers.

DreamHost's immediate response

DreamHost terminated active sessions of affected users, reset their passwords, and addressed the exploited vulnerability. It is working with legal advisors and security experts.

“We believe this as a deliberate attack, and our team worked around the clock to contain it.”

Customers offered credit monitoring

DreamHost urged customers to review statements, monitor credit reports, place fraud alerts, and notify police of suspicious activity. It offered one year of free credit monitoring.

No public claims or leaked data yet

So far, no threat actors have claimed responsibility for the breach, and the stolen data has not yet appeared on the dark web.

DreamHost's history of security incidents

This is not DreamHost's first breach. In 2012, attackers accessed a database server exposing FTP and shell-access passwords. In 2017, the company suffered a major DDoS attack.