DreamHost breach: hackers stole FTP and webmail logins

What happened at DreamHost?

DreamHost discovered unauthorized access to the server running its web-based File Manager (files.DreamHost.com) about two weeks ago, but the attackers had been inside since August 2026.

The entry point was a vulnerability in the File Manager software, which DreamHost has not detailed. Once inside, the attackers could grab FTP/SFTP usernames and passwords from logged-in users, and they also reached some webmail systems to obtain session information—including credentials—for a 'limited number' of webmail users.

The company says it has no evidence that control panel logins or customer billing details were accessed. DreamHost doesn't store full payment card numbers, only secure tokens that can't be used elsewhere.

DreamHost has terminated active sessions for potentially affected users and reset their passwords. If you try to log in and find your password has been reset, the company considers your data breached.

Why stolen FTP and webmail credentials matter

Credentials are the keys to your digital kingdom, and once they're in the wrong hands, the damage can spread far beyond the initial breach.

With FTP/SFTP access, an attacker could upload malicious files, deface websites, or use the server as a launchpad for further attacks. Webmail access is even more sensitive: it can be used to send spam, launch phishing campaigns, or carry out business email compromise (BEC) attacks that are notoriously hard to detect.

DreamHost is urging customers to review their statements, monitor credit reports, and consider placing a fraud alert. The company is offering one year of free credit monitoring and identity theft protection through Equifax.

The investigation is ongoing, and DreamHost says it will update customers if it finds anything significant. So far, no threat actor has claimed responsibility, and the data has not appeared on the dark web.

DreamHost's security track record

This isn't the first time DreamHost has faced a security incident.

In 2012, attackers accessed a database server and potentially exposed customer FTP and shell-access passwords. Five years later, a major DDoS attack on its DNS infrastructure caused widespread connectivity issues.

The company says it has implemented additional security measures and is working with outside legal advisors and forensics experts, though it hasn't specified what those measures are.

What it means for you

If you're a DreamHost customer in the US, UK, or EU, check your email for a breach notification. Even if you haven't received one, it's wise to change your DreamHost password and any passwords reused elsewhere. Enable two-factor authentication if you haven't already.

DreamHost's offer of Equifax credit monitoring is available to affected individuals, but you'll need to follow the instructions in the notification to enroll. The breach highlights the importance of unique passwords and regular security audits for anyone running a website.

DreamHost's breach is a reminder that even the tools we use to manage our websites can become attack vectors. The company's response—password resets, credit monitoring, and an ongoing investigation—is standard, but the onus is now on customers to secure their accounts and stay vigilant.