The facts
DreamHost said it discovered an unauthorized third party on 23 October on the server running its web-based File Manager and took the servers offline while investigating. [1]
The company said the intruder accessed FTP/SFTP usernames and passwords for users who logged into File Manager before detection and obtained credentials for a limited number of webmail users; a small number of mailboxes may have been viewed. [1]
DreamHost estimated a fraction of email and FTP/SFTP accounts, well under approximately 10%, were affected. TechCrunch reported the company declined to provide an exact count. [1][2]
DreamHost said it reset potentially affected passwords, ended active sessions, addressed the vulnerability and found no evidence of access to control-panel logins or customer billing details. [1]
TechCrunch reported that a California attorney-general filing said the attack began in August and involved session tokens; the specific software vulnerability remains undisclosed. [2]
Still unconfirmed
- The number of affected customers or accounts; DreamHost has not provided an exact count.
- Whether credentials were used beyond the small number of mailbox views the company believes may have occurred.
- Whether website files were copied or altered; DreamHost’s notice does not provide a complete account of file access.
- The attacker’s identity, motive and the underlying third-party software vulnerability.
Sources
References support the numbered facts above. Source checks: 8 Nov 2026, 01:23 UTC.
The primary company notice and TechCrunch reporting on a state breach filing support the reported access window and credential exposure. The company’s estimate has not been independently audited; the exact number and extent of data accessed remain unknown.
- October Security Incident
DreamHost · Primary source · 29 Oct 2026
Opened the company notice. DreamHost says it discovered access on 23 October, that credentials for File Manager users’ FTP/SFTP and some webmail accounts were exposed, that a small number of inboxes may have been viewed, and that it found no evidence of panel or billing access.
- Hackers stole DreamHost customer files and inboxes during months-long attack
TechCrunch · Reporting · 4 Nov 2026
Opened independent reporting. It says a California breach filing described an attack beginning in August and obtained session tokens, while DreamHost declined to give a precise affected-customer count.