DreamHost, a web hosting and email provider, has notified customers of a data security incident involving its web-based File Manager and webmail systems. The company says an unauthorized third party obtained login credentials, and that email contents and website files may also have been accessed.
A hosting company holds the passwords, email and website files of the people and businesses that depend on it, and it has a responsibility to protect them. This page summarizes what DreamHost has disclosed so far.
DreamHost, LLC’s Data Breach Investigation
DreamHost says that on the afternoon of Friday, October 23, 2026, it discovered that an unauthorized third party had accessed the server that runs its web-based File Manager at files.dreamhost.com. According to the company, the attacker exploited a vulnerability in the software and was able to obtain the FTP and SFTP usernames and passwords of people who logged into the File Manager during the period it was exposed. The sample notice letter DreamHost filed with the California Attorney General describes that period as approximately August 2026 through October 23, 2026.
The company also says the intruder was able to reach certain webmail systems. In the notice letter, DreamHost says this may have exposed session information, meaning the data that keeps a user signed in, for a limited number of webmail users. The company’s public announcement says the attacker obtained login credentials for a limited number of webmail users, and that in a small number of cases the attacker may have used them to view the contents of a mailbox. DreamHost says it is contacting those customers individually.
The letter states that the information involved may include the username and password used to access the File Manager or webmail. It adds that the contents of email and files stored on the FTP and SFTP servers may also have been accessed. This matters because many people store far more than passwords in those places. Email accounts often hold financial statements, scanned identity documents and password reset links, and website file areas can hold customer lists, configuration files and database credentials.
DreamHost says that, based on its investigation so far, it found no evidence that the attacker accessed control panel logins or customer billing details. It also says it does not store full payment card numbers and keeps only a token that cannot be used to make purchases elsewhere. The company says its investigation is ongoing and that it will update customers if it discovers significant additional information.
After finding the problem, DreamHost says it took the File Manager servers offline, addressed the vulnerability and began an investigation with outside legal advisors and security and forensics experts. It reset the passwords of email and FTP/SFTP users whose credentials may have been exposed and ended active sessions. Reports from technology news sites say the File Manager came back online on October 26, 2026, and that affected users could not sign in until the account owner set new passwords. DreamHost says its continuing investigation suggests that fewer customers were affected than it first suspected, and that not everyone who received the first email from the company was affected.
DreamHost has not said how many customers or accounts were affected, and the notice does not say who the attacker was or whether any data was published or sold. The sample letter filed with the California Attorney General is a template with blank fields for the recipient’s name and other details, so it does not show what any individual customer was told about their own information. Customers who received a message from DreamHost, or whose email or FTP accounts were reset, are the people most likely to be affected.
The risks go beyond the stolen passwords themselves. If a customer used the same password on other sites, an attacker could try it elsewhere, which is why the notice tells people to change any reused password. Anyone whose mailbox was read could be exposed to targeted phishing that refers to real messages, and a website owner could face unwanted changes to site files. DreamHost offers affected customers one year of free identity theft protection through Equifax, according to the sample notice.
If DreamHost releases further details about the cause, the number of customers involved or the period of exposure, those sources will be the most reliable basis for understanding the full scope of the incident. Until then, this page relies on the company’s own announcement and the notice it filed.
When Did This Breach Occur?
DreamHost says it discovered the unauthorized access on October 23, 2026. The notice letter says the attacker could capture FTP and SFTP credentials of people who logged into the File Manager from approximately August 2026 through October 23, 2026, so the exposure may have lasted for months before it was detected.
Technology news reports say password resets for affected accounts were completed on October 24, 2026, and that the File Manager was restored on October 26, 2026. DreamHost has not published a date by which all affected customers were notified.
What Information Was Breached?
According to DreamHost, the information involved may include FTP and SFTP usernames and passwords, webmail login credentials and session information for a limited number of users, and in some cases the contents of email and files stored on FTP and SFTP servers.
DreamHost says it found no evidence that control panel logins or customer billing details were accessed. Not every customer was affected in the same way, so check any notice you received for what applies to you.
What You Can Do
If you are a DreamHost customer or received a notice from the company, consider these steps:
- Change your DreamHost-related passwords, and change the same password anywhere else you used it. Use a password manager and turn on two-factor authentication where it is offered.
- Review your email account settings for unfamiliar forwarding rules or filters, and check your website files for unexpected changes.
- Think about what your email and stored files contain, and secure any other accounts that could be reached from them.
- Enroll in the free Equifax identity theft protection offered in your notice, if you received one, before its enrollment deadline.
- Place a free fraud alert or credit freeze with Equifax, Experian and TransUnion, and get your credit reports free at annualcreditreport.com.
- Be skeptical of unexpected emails that mention the incident, since DreamHost says it will never ask for your password by email. Report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against DreamHost, LLC
If you are a DreamHost customer whose accounts or information were involved in this incident, you may have legal options. A data breach lawsuit can seek compensation for the loss of privacy, the time spent securing your accounts and any out-of-pocket costs, and can press a company to improve how it safeguards customer data. Whether a claim makes sense depends on the facts of the incident, which are still developing. Keep your notice and any records of suspicious activity or expenses, since they may matter later.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
