DreamHost Says File Manager Breach Exposed Some Passwords

What happened in the DreamHost security incident?

The DreamHost security incident involved unauthorized access to the server running files.dreamhost.com, which DreamHost discovered on October 23, 2026. DreamHost says the attacker exploited a vulnerability in third-party software used by its browser-based File Manager, a tool that lets customers manage website files through a browser rather than an FTP or SFTP application.

DreamHost took File Manager servers offline after identifying the issue. The company publicly described the incident on October 29 and said the relevant File Manager login period ran from approximately August 2026 through October 23, 2026. DreamHost’s incident disclosure identifies that time frame and explains that the exposure is connected to File Manager use, not every DreamHost account automatically.

The primary risk is credential exposure, not a confirmed compromise of every hosted website or mailbox. That distinction matters because a password that may have been accessed requires prompt replacement even when a customer has not seen suspicious activity. The practical response is to treat a password-reset notice from DreamHost as a security action that needs completion, rather than as a routine service message.

Which DreamHost accounts may have been affected?

DreamHost says FTP/SFTP usernames and passwords may have been accessed for users who logged into File Manager before the incident was detected. FTP and SFTP credentials are commonly used to connect to a hosting account and manage website files, so affected users should review which credentials they used through the browser-based File Manager during the stated period.

DreamHost also says a limited number of webmail users had login credentials obtained during the incident. In a small number of cases, DreamHost believes mailbox contents may have been viewed. The company says the incident affected “well under approximately 10%” of hosted email and FTP/SFTP accounts, but that estimate does not remove the need for affected users to change their own credentials.

The DreamHost incident is separate from other recent account-security events, such as the reported saved-card exposure at Revolve. The relevant response differs by incident because DreamHost has specifically identified File Manager, FTP/SFTP credentials, and webmail credentials as the affected areas.

What did DreamHost do after finding the File Manager breach?

DreamHost says it took File Manager servers offline, reset potentially exposed email and FTP/SFTP passwords, and ended active sessions after discovering the unauthorized access. Those actions are intended to prevent a previously exposed credential or open session from continuing to provide access after the company’s response began.

DreamHost also says it found no evidence that control-panel logins or billing details were accessed. That statement is important because the control panel can be a central place for managing hosting services, but it is not a guarantee that an account holder can ignore the reset request for an affected email, FTP, or SFTP credential.

DreamHost’s reset action reduces ongoing access risk, but customers still need to complete the account-specific steps. A reset can interrupt email clients, website publishing tools, or other services that still hold an older password. Account holders should identify any connection that stops working after a reset and update it with the new credential only after confirming the service and account are legitimate.

The service disruption also affected account access for some users. A report from BleepingComputer said affected users could not sign in until their account owner reset the credentials. The practical implication is that users on shared or managed hosting accounts may need to contact the designated account owner rather than trying repeated sign-in attempts.

What should DreamHost users do now?

DreamHost users should reset any affected email and FTP/SFTP passwords in the DreamHost control panel, especially if they used File Manager from approximately August 2026 through October 23, 2026. DreamHost instructed account holders to reset affected credentials and review each mailbox’s forwarding settings for unknown rules. DreamHost’s current-status guidance provides the company’s password-reset and mailbox-review direction.

1. Sign in to the DreamHost control panel using the official account route.
2. Reset any email, FTP, or SFTP password identified in DreamHost’s notice or used with File Manager during the affected period.
3. Review each hosted mailbox’s forwarding settings and remove any rule you do not recognize.
4. Update legitimate email applications, FTP clients, website tools, and other services that use the old password.
5. Contact DreamHost support or the account owner if the reset process prevents access or the account settings show activity you cannot explain.

DreamHost users should review mailbox forwarding rules carefully because an unfamiliar forwarding destination can affect where new messages are delivered. A password change addresses the credential itself, while a forwarding-rule review checks whether the mailbox configuration needs correction after the suspected exposure.

The most sensible approach is to complete DreamHost’s documented account steps before making unrelated hosting changes. Do not delete website files, alter DNS records, or make broad configuration changes merely because File Manager was involved. Stop and contact DreamHost support if the account shows unfamiliar settings that you cannot safely identify or reverse.

Why does checking mailbox forwarding matter after the breach?

Mailbox forwarding settings matter because DreamHost specifically told users to look for unknown forwarding rules after the incident. A forwarding rule can direct incoming messages to another address, so the setting deserves review separately from the password reset process.

DreamHost account holders should inspect every mailbox that may have been affected, not only the mailbox used most often. The company’s guidance identifies mailbox forwarding as a relevant follow-up step, which means users should compare the listed forwarding destinations with the addresses they expect to see before removing anything.

An unfamiliar forwarding rule is a reason to stop and contact DreamHost support if you are unsure what the setting does. Removing a legitimate business forwarding rule can interrupt normal mail delivery, while leaving an unfamiliar one in place can conflict with DreamHost’s security guidance. A careful review is more appropriate than guessing which settings are safe to delete.

Mailbox configuration reviews have become an important part of breach response because account access can involve more than a single password. Readers following reports about exposed account email records should also distinguish between a disclosed data category and the specific remediation instructions issued by the affected company.

What does DreamHost’s “no evidence” statement mean?

DreamHost says it found no evidence that control-panel logins or billing details were accessed in the incident. The statement describes what DreamHost had identified when it published its October 29 disclosure, and it narrows the company’s stated scope to File Manager-related FTP/SFTP credentials and a limited number of webmail credentials.

DreamHost’s statement does not mean every account holder should assume no action is required. The company reset potentially exposed passwords because the relevant risk was access to credentials for users who logged into File Manager before the issue was detected. The appropriate action depends on whether an account received a reset or was used with File Manager during the stated window.

Users should also avoid treating an absence of evidence as a reason to reuse an affected password elsewhere. DreamHost’s public guidance is focused on DreamHost account credentials and mailbox settings, so the direct response is to follow that guidance and monitor future notices from the company if its understanding of the incident changes.

What is still unknown about the DreamHost incident?

DreamHost has not publicly stated how many individual accounts were affected, which specific customers had credentials accessed, or how many mailboxes may have had contents viewed. The company said the affected group was well under approximately 10% of hosted email and FTP/SFTP accounts, but the disclosure does not provide a precise account total.

DreamHost also has not publicly identified the third-party File Manager software vulnerability by name in the information provided with its October 29 disclosure. That limitation means customers should not rely on unverified claims about a particular software product, vulnerability identifier, or attack method when deciding how to respond.

The confirmed facts support a narrow but serious response: reset affected passwords, inspect forwarding rules, and use DreamHost’s official notices as the source of account-specific instructions. Hosting customers should be cautious with unsolicited messages that claim to offer a reset, particularly during an active incident, and should use the established DreamHost account route rather than following an unexpected link.

Other hosting and web-security incidents can involve different attack paths, including the hijacking of browser extensions. DreamHost users should keep the response focused on the company’s stated File Manager exposure and avoid assuming that unrelated security reports establish what happened in this incident.

FAQ

Did the DreamHost breach expose all customer accounts?

No, DreamHost says the incident affected well under approximately 10% of hosted email and FTP/SFTP accounts. DreamHost linked the exposure to users who logged into File Manager during an approximately August 2026 through October 23, 2026 window.

Were DreamHost billing details exposed?

No, DreamHost says it found no evidence that billing details were accessed. DreamHost also says it found no evidence that control-panel logins were accessed.

Should DreamHost users change their FTP and SFTP passwords?

Yes, DreamHost users who received a reset notice or used File Manager during the affected period should reset affected FTP/SFTP passwords. DreamHost says potentially exposed FTP/SFTP credentials were reset as part of its response.

Should DreamHost webmail users check forwarding rules?

Yes, DreamHost webmail users should review each mailbox for unknown forwarding rules. DreamHost specifically instructed account holders to check forwarding settings after the incident.

What should DreamHost users do if they cannot sign in after a reset?

DreamHost users should contact the account owner or DreamHost support if a password reset prevents access. Affected users may need an account owner to reset credentials before they can sign in again.