DreamHost, the American provider of web hosting and domain registration services, announced that it has been subject to a cybersecurity incident that led to the exposure of sensitive data of its customers. According to the official notice, an unauthorized third party was able to access the server responsible for running the company's File Manager platform on the domain files.dreamhost.com.
Breach Details and Scope of Impact
The unauthorized access continued between August 2026 and October 23, 2026, which is the date the company discovered and remediated the security vulnerability. Attackers exploited a software vulnerability in the File Manager platform to access usernames and passwords for File Transfer Protocols (FTP/SFTP) for users who logged into the platform during that period.
Additionally, the company indicated that attackers may have been able to access Webmail systems, leading to the exposure of session information and some credentials for a limited number of users. DreamHost confirmed that it terminated active sessions and invalidated affected passwords immediately upon discovering the incident.
What Does This Mean for Users?
Although the company found no evidence of attackers accessing account control panels or billing and payment data (which are managed via an external provider), the incident poses direct security risks. Affected users are advised to take the following steps:
- Review website files for any unauthorized changes.
- Check email forwarding rules and filters to ensure they have not been tampered with.
- Change passwords immediately, especially for other accounts that may use the same credentials.
As a precautionary measure, DreamHost is providing affected individuals with credit monitoring and identity theft protection services for a full year through Equifax, and also urges them to consider activating fraud alerts or freezing their credit reports.
It is worth noting that the company has not yet disclosed the exact number of affected accounts, despite repeated inquiries from technical entities, leaving open questions about the actual scale of the technical damage to the platform's user base.