TechCrunch reported on Nov. 4 that hackers stole customer files and inboxes from web host DreamHost over a months-long attack, which is why we are covering it now. DreamHost itself posted its notice on Oct. 29, so the company has been telling customers for about a week.

If you host a site or email with DreamHost, the short version is to reset your FTP, SFTP and email passwords and check your webmail for rules you did not create. The steps are below.

What happened in the DreamHost data breach

DreamHost says an unauthorized third party exploited a vulnerability in third-party software behind its web File Manager at files.dreamhost.com. The company found the problem on the afternoon of Friday, Oct. 23, took the File Manager servers offline and fixed the vulnerability. Its investigation is ongoing.

The attacker got FTP and SFTP usernames and passwords for users who logged in to File Manager before Oct. 23. DreamHost says the attacker also reached certain webmail systems and took login credentials for a limited number of webmail users. In a small number of cases, mailbox contents may have been viewed.

DreamHost says it has no evidence so far that control panel logins or billing details were accessed. It adds that it does not store full card numbers. DreamHost says it is notifying regulators and that this is not related to recent PHP server updates.

Who is affected

DreamHost says a fraction of email and FTP/SFTP accounts were hit, "well under approximately 10%". That report puts that against about 400,000 paying customers and says the attack began in August.

You may be affected if you, or an FTP/SFTP user on your account, logged in to File Manager between about August 2026 and Oct. 23, 2026. DreamHost says to treat those credentials as compromised.

Email users may also be affected if you were signed out on or after Oct. 23 and your old password stopped working. DreamHost calls that a precautionary reset. If your old password still works and you never changed it, DreamHost says its investigation indicates it was not exposed, though it still recommends changing it.

What to do

  • Reset the password for every affected mail, FTP and SFTP user. Only the account holder can do this, from the control panel, and it can take up to 15 minutes to apply.
  • Change the password anywhere else you reused it, and use a strong, unique password for each service. A password manager helps, and our passkeys how-to shows how to skip passwords on services that support them.
  • Update the password stored in any email, FTP or SFTP app on your devices, so it does not keep retrying the old one.
  • Review your website files for changes you do not recognize.
  • If you hold data about your own customers, DreamHost says you may want legal advice.

DreamHost webmail: check for forwarding rules and filters

If you use DreamHost webmail, reset your password first. Then open your forwarding rules and filters and look for anything you did not create. A rule that quietly copies your mail to another address is a common way to keep reading an inbox after a password changes.

Also check the sites on your account. Because FTP and SFTP logins were taken, look through your site files for unfamiliar changes, and reset those logins even if everything looks normal.

Watch for phishing

Breach notices are a favorite cover for scams. DreamHost says it will never email you asking for your password, and that its incident emails will not ask you to sign in through a link.

If you get a message about this, do not click it. Go straight to panel.dreamhost.com by typing it in your browser. The same habit helps after any breach, as in our story on the mSecure password manager database breach.

What is not known

DreamHost's investigation is still going. The report adds that DreamHost declined to say why it did not detect the attack sooner, so it is unclear why the problem was found only on Oct. 23 when the attack reportedly began in August.

The same report says the attacker obtained session tokens. That detail is not in DreamHost's notice, so we are attributing it to the report only. DreamHost has not named the third-party software or the exact flaw.