On the afternoon of Friday, October 23, we discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com. Upon discovery, we immediately took the File Manager servers offline, addressed the vulnerability, and began an investigation into the nature and scope of the incident. As a precaution, we also reset the passwords of the email and FTP/SFTP users whose credentials may have been exposed based on the investigation at the time, and notified such users that their passwords would need to be reset.
Our ongoing investigation suggests that not everyone who received that initial email from us was affected, and fewer customers are known to be affected at this time than originally suspected. If you did not receive an email from us regarding this issue, no action is needed at this time, but out of caution you may wish to consider the precautions outlined below.
This post explains what happened, who was affected, and what impacted DreamHost users should do now.
What Happened
The File Manager at files.dreamhost.com is a browser-based tool, built on third-party software, that customers use to work on the files on their websites.
The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of users who logged into this File Manager before the activity was detected on October 23, 2026. The unauthorized third party was also able to reach certain webmail systems and obtain the login credentials of a limited number of webmail users. We reset those passwords and ended active sessions the same day. In a small number of cases, we believe the unauthorized third party may have used those credentials to view mailbox contents; in such cases, we are in the process of contacting those customers individually.
This was a deliberate attack, and our team worked around the clock to contain it.
After the incident was discovered, we took immediate steps to stop the unauthorized third party’s access, address the exploited vulnerability and remediate the impacts of the unauthorized access, and begin an investigation of the scope of the incident. We also terminated active sessions of users who may have been affected and reset their passwords.
Based on our investigation to date, we have found no evidence that the unauthorized third party accessed control panel logins or customer billing details. DreamHost does not store full payment card numbers; card payments are handled by a third-party payment processor.
How we’ve been keeping you informed
Throughout this event, we’ve been posting updates on our status blog. On Friday evening and throughout the weekend, we emailed account owners to let them know that we had reset the passwords of email and FTP/SFTP users on their accounts, and how to set new ones. Those emails do not ask for your password.
We are currently notifying applicable regulators of the incident as required by law. We will also be sending formal notices in the coming days in accordance with the laws of the countries where affected users are located that provide further guidance on how users can protect themselves.
Who Was Affected
At this time, our current analysis indicates this incident affected a fraction of email and FTP/SFTP accounts hosted at DreamHost, well under approximately 10%.
You may be affected if:
- You, or an FTP/SFTP user on your account, logged into File Manager between approximately August 2026 and October 23, 2026. Please treat those usernames and passwords as compromised. If you use the same or a similar password for any other account or service, we recommend changing it there as well.
- An email user on your account was signed out and the old password stopped working on or after October 23. That was us: we reset the passwords of mailboxes that we believed could have been affected while we continued our investigation.
We took these steps out of an abundance of caution for our users based on our ongoing investigation. Even if one of the above applies to you, it does not necessarily mean that you were affected.
If a previously-working password on an email or FTP/SFTP account still works and you have not changed it yourself, our investigation to date indicates that it was not exposed in this incident, although we would encourage you to change it as an added precaution. If you are unsure if you or any of the user accounts on your DreamHost account are affected, our support team is ready to help at https://panel.dreamhost.com/support/.
What you should do
Affected mail, FTP, and SFTP users’ accounts are still active and functional, but these users will need to have their passwords reset before they can sign in again and use these services. For your security, only the DreamHost account holder can set new passwords from inside the DreamHost account control panel.
We know this is an inconvenience. These Knowledge Base articles will walk you through it:
Note that a changed password may take up to 15 minutes to take effect.
A few other precautions we recommend:
- Use strong, unique passwords for every user on your DreamHost account.
- Update any email, FTP, or SFTP clients that have the old passwords saved.
- Look over your website files for any changes you don’t recognize.
- Check your webmail settings, especially forwarding rules and filters, for anything you didn’t set up yourself.
If you use DreamHost to store information about your own customers, clients, or users, you may wish to consult your own legal advisors about any additional obligations you may have regarding this incident. DreamHost is committed to working with you and providing you with any necessary information to support these obligations.
Protect Yourself from Phishing Attacks
Incidents like these are often followed by scam emails that imitate the companies involved. Please keep these points in mind:
- DreamHost will never email you asking for your password.
- Apart from the incident notices described in this post, email and FTP/SFTP users do not receive automated messages asking them to reset or confirm passwords, and our incident emails will never ask you to sign in through a link.
- Account passwords can only be changed by the DreamHost account holder from the account control panel at https://panel.dreamhost.com/ (we recommend typing this address directly into your browser and not clicking any other links that you may be provided).
Your Websites and Email Remain Available and Active
Your websites and email have remained available throughout this incident. Inboxes continue to receive email whether or not passwords have been reset, and your files remain in the FTP/SFTP accounts.
What We Are Doing
- We have reset the passwords of any impacted user accounts and notified potentially impacted customers.
- The affected File Manager server has been taken out of service and preserved for our forensic investigation.
- We have rebuilt and launched File Manager with additional security precautions and enhanced monitoring before bringing it back online.
- We rotated internal credentials that may have been exposed and addressed the vulnerability identified as the cause of the incident.
- We are conducting reviews of other customer-facing tools used by DreamHost for similar vulnerabilities.
- We have retained outside security and forensics experts to work alongside our internal teams while we investigate this incident. That work is ongoing, and we will update you if there are any significant developments.
- We are notifying applicable regulatory agencies of this incident and making all required initial disclosures. We will update applicable regulators and our users about significant developments as our investigation continues.
- We will continue to review and strengthen our security measures to prevent a similar incident.
PHP Note:
This incident was not related to recent PHP server updates. Our PHP servers were patched within hours of the patches’ availability, and our web application firewall successfully blocked the tens of thousands of intrusion attempts we saw in the days leading up to their release.
We understand that these password resets are a large inconvenience to all of our affected users. Thank you for your patience as our team works to secure our systems and support affected customers. We remain committed to earning and keeping your trust.
If you have any questions, our support team is available at https://panel.dreamhost.com/support.