Reset your DreamHost passwords today
DreamHost says an attacker took FTP/SFTP and some webmail logins through its File Manager, and tells users to treat them as compromised and reset them.
If your business website lives on DreamHost, the company wants you to assume your file-upload password is in someone else's hands. DreamHost says an attacker got into the server behind its web-based File Manager and took the FTP/SFTP logins of people who used it. DreamHost's incident post is blunt about it: "Please treat those usernames and passwords as compromised."
That applies to anyone who logged into DreamHost's File Manager "between approximately August 2026 and October 23, 2026", according to DreamHost. October 23 is the day DreamHost says it discovered the access. DreamHost puts the share of email and FTP/SFTP accounts affected at "well under approximately 10%".
The attacker reached files and some webmail
DreamHost says the attacker exploited a vulnerability in the File Manager's third-party software, then reached certain webmail systems and obtained "the login credentials of a limited number of webmail users." In "a small number of cases", DreamHost says, the attacker "may have used those credentials to view mailbox contents".
The notice DreamHost filed with the California attorney general words the webmail part differently. It says the access "may have exposed the session information (the data that keeps a user signed in, including session credentials)" of a limited number of webmail users, and that email and files on the FTP/SFTP server "may have also been accessed."
DreamHost says it has found no evidence to date that control panel logins or customer billing details were accessed, and that it does not store full payment card numbers. It says it rotated internal credentials, addressed the vulnerability and that the incident was not related to recent PHP server updates.
Your passwords have to be reset before you can sign in
Affected accounts still exist, DreamHost says, but users "will need to have their passwords reset before they can sign in again and use these services." Only the DreamHost account holder can set new passwords, from inside the control panel, and a change "may take up to 15 minutes to take effect."
DreamHost says it will never email you asking for your password, and it recommends typing panel.dreamhost.com into your browser rather than clicking links.
The notice filed with the attorney general says DreamHost has arranged identity theft protection from Equifax "for one year, at no cost to you." DreamHost's post does not mention it.
Mailbox rules and site files are the quieter risk
A new password locks the door. It does not undo what someone may have done while they had the key. In our view, DreamHost's advice is right and quick to follow, but two checks after the reset are easy to skip.
Picture, as our own example, a bakery whose order inbox quietly forwards every customer email to a stranger. Or a plumber's site where one page now links somewhere it never did. DreamHost itself tells customers to look for both.
What this means for your business
If you or anyone on your team logged into DreamHost's File Manager between about August and October 23, do three things today.
- Sign in to panel.dreamhost.com yourself, as the account holder, and set new FTP/SFTP and webmail passwords. Allow up to 15 minutes for them to work, then update any email or FTP apps that have the old passwords saved.
- "Check your webmail settings, especially forwarding rules and filters, for anything you didn’t set up yourself." That is DreamHost’s own advice.
- "Look over your website files for any changes you don’t recognize."
If you used the same or a similar password anywhere else, change it there too. If you keep your own customers' information on DreamHost, the company suggests you "consult your own legal advisors about any additional obligations you may have regarding this incident." If you get the notice letter, it explains the Equifax offer.
DreamHost has not said which hosting plans were affected, how many accounts that share covers or which software was vulnerable.
Sources
- DreamHost, October security incident.
- DreamHost data security breach notice letter, filed with the California Attorney General.
- California Attorney General, data breach record for DreamHost, LLC.
This article was researched, written and fact-checked by MasterNodeAI's AI newsroom agents.
Related: Security & Regulation desk
MasterNodeAI is building an AI interface that helps small and medium business owners run their business. Join the waitlist and we will let you know when you can try it.