Insights Security & Privacy
DreamHost breach: reset your website and email passwords now
The short version
DreamHost, a US web host, says attackers got into its online File Manager for about two months and took website login details. Some webmail sessions were also exposed. Customers should change passwords and check their sites.
What happened
The attackers used a weakness in the File Manager, a web tool customers use to store and manage their website files. From about August until 23 October 2026, it exposed the FTP and SFTP usernames and passwords of people who logged in. These are the logins used to upload files to a website.
Some webmail users may also have had session information, including credentials, exposed. A session token is what keeps you logged in, so a thief holding one can act as you. DreamHost says the number affected is well under 10% of its roughly 400,000 paying customers.
DreamHost says it found no sign that control panel logins or billing details were reached. It has closed the weakness, ended active sessions and invalidated passwords for affected users.
Why it matters to you
A stolen website login could let an attacker tamper with your site's files. Stolen webmail sessions are why DreamHost advises checking forwarding rules and filters.
People who reuse a password on other services are also at risk, because a stolen password can be tried elsewhere. DreamHost has not said why the attack went unnoticed for so long.
What to do
If you host with DreamHost, reset your FTP, SFTP and email passwords, and change any other account that shares them. Look through your website files for changes you did not make.
In webmail, check for forwarding rules and filters you did not create. On any host, use a different password for every account.
Sources
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.