DreamHost Confirms Data Breach: FTP Passwords and Webmail Are Compromised—Here’s What You Need to Do

The hosting company DreamHost has officially confirmed a cyberattack in which attackers gained access to FTP/SFTP login credentials and some webmail data. Although the breach itself occurred in August 2026, the company did not inform the public about the incident until November 5, 2026. If you use this provider’s services, it is essential to immediately check the security of your website and email accounts.

What Exactly Happened

According to the official announcement dated November 5, 2026, attackers exploited a security vulnerability in the File Manager service on DreamHost’s servers.

Although the breach occurred in August 2026, it took the company several months to investigate and analyze the exact scope of the compromise. During this period, DreamHost identified the affected accounts, forcibly terminated their active login sessions, and forced password resets for the affected users. However, the company emphasizes that all clients should take preventive measures, not just those it contacted directly.

What Data Was Compromised

During a limited time window, the attackers had access to the following information:

1. FTP/SFTP login credentials: Usernames and passwords used to access website files directly.
2. Webmail data: Some email messages and attachments stored directly on the hosting server (not with external providers such as Gmail or Outlook, unless set up for forwarding).
3. Hosting account metadata: Information about the account structure and associated domains.

DreamHost stated that no payment information or passwords to the main administrative panel were compromised (provided they were protected by a strong password and 2FA), but FTP access poses a critical risk.

4 Steps You Must Take Immediately

If you’re a DreamHost customer, don’t wait for an email from the company. Follow these steps:

1. Change all your passwords

Immediately change your DreamHost control panel password, as well as the passwords for all FTP/SFTP accounts associated with your domains. Use strong, unique passwords that you do not use on other services.

2. Enable two-factor authentication (2FA)

Enable two-factor authentication in your DreamHost account settings. This step will significantly reduce the risk that attackers could exploit your new password, even if they somehow obtained it.

3. Check the list of FTP users

Log in to the control panel and go to the FTP account management section. Verify that there are no unknown users on the list. If you find a suspicious account, delete it immediately and change the master password.

4. Monitor your email and notify clients

Since part of the webmail system was compromised, there is a risk that attackers could misuse this data for targeted phishing attacks against you or your clients. Be cautious of suspicious emails and consider proactively notifying your customers that they should be on guard due to the incident at the hosting provider.

Why a hosting data breach is critical

Access to FTP/SFTP is the equivalent of a house key for an attacker. It allows them not only to read files but also to modify them. An attacker can discreetly inject malicious code (malware) into a website, redirect visitors to fraudulent sites, or gain access to database configuration files, which often store additional sensitive data.

Furthermore, the combination of access to files and webmail provides attackers with enough context to create highly credible phishing emails that can deceive even cautious users.

Conclusion

The DreamHost incident serves as a reminder that website security isn’t just about updating WordPress or another CMS. Vulnerabilities on the hosting provider’s side can occur, and website operators bear the brunt of the consequences. A quick response, changing login credentials, and enabling 2FA are currently the most effective defenses.