Web host DreamHost has confirmed that a months-long cyberattack exposed emails, login credentials and files belonging to some of its customers. TechCrunch reported the DreamHost breach on November 4, 2026, days after the company disclosed the incident in late October. If your business rents hosting, email or file storage from a third party, this one is worth a careful read.

A file-management tool became the way in

According to DreamHost's own notice, the company discovered on the afternoon of Friday, October 23, 2026 that an unauthorized party had accessed the server running its browser-based File Manager. It took those servers offline, patched the vulnerability and began investigating.

The File Manager is built on third-party software, and that is where the flaw sat. DreamHost says the attacker exploited a vulnerability in that software and obtained the FTP/SFTP usernames and passwords of anyone who had logged into the tool before the activity was caught. The company has not named the vulnerability, and, per TechCrunch, it would not explain why detection took until last week.

Active since August, and it reached webmail too

The breach notice DreamHost filed with California's attorney general says the attack began in August. As TechCrunch describes it, the attacker also obtained session tokens, the small pieces of data that keep you logged in after you enter a password. A stolen token lets an intruder act as that user.

The damage did not stop at FTP. DreamHost acknowledged that the attacker reached some webmail systems and took the credentials of a limited number of webmail users. In a small number of cases it believes those credentials were used to view mailbox contents, and it is contacting those customers one by one.

The incident had already caused an outage lasting several days, during which DreamHost reset some customers' passwords. The company also says the flaw is unrelated to the recent critical PHP vulnerabilities.

Under 10% affected, but the exact number is unknown

DreamHost says the affected share of email and FTP/SFTP accounts is well under roughly 10%. Its spokesperson would not give TechCrunch a more precise figure. The company's own site cites about 400,000 paying customers, so even a small percentage could mean tens of thousands of accounts. That estimate is our own arithmetic from two public figures, not a number DreamHost has confirmed.

On the reassuring side, the company says it has found no evidence that control panel logins or billing details were accessed. It adds that it does not store full card numbers, because payments go through a third-party processor. The investigation is still ongoing, so these statements may change.

Why this matters beyond DreamHost customers

The pattern is a familiar one. The weak point was not the core infrastructure but a secondary tool built on someone else's software. File managers, webmail and side panels rarely get the monitoring that main systems do, which is how an intruder can stay inside for roughly two months unnoticed.

For software teams, two lessons stand out. Every third-party component you embed in a product becomes part of your attack surface. And long-lived sessions without fast revocation turn a single leaked token into a master key.

What to do this week

If you use DreamHost, follow its guidance first. The company advises treating the FTP/SFTP credentials of anyone who logged into File Manager between about August and October 23, 2026 as compromised, and changing any reused password elsewhere. Its emails about the incident never ask for your password.

For everyone else, this is a good moment to check the basics:

  • Rotate credentials on externally hosted services, and never share one password across email, FTP and control panels.
  • Turn on multi-factor authentication and use a password manager. We cover the practical steps in our guide to enabling 2FA, password managers and passkeys.
  • Prefer SFTP with SSH keys over passwords, and avoid web-based file managers unless you truly need them.
  • Shorten session lifetimes and have a runbook to revoke all sessions at once when you suspect an incident.
  • Watch for opportunistic phishing. After a breach, attackers often impersonate the provider, so refresh your team's skills with our guide to spotting phishing emails and messages.

What we still don't know

Key questions remain open: which software was exploited, why monitoring missed it for so long, and how many customers were really affected. DreamHost says it will send formal notices and is informing regulators as required. We will update this story as reliable details emerge.

Conclusion

The DreamHost case shows that security risk often hides in overlooked components and can persist for months before anyone notices. To review your exposure, session management and third-party dependencies, contact the Besoft team for a consultation.

Sources

  • TechCrunch, "Hackers stole DreamHost customer files and inboxes during months-long attack", November 4, 2026: https://techcrunch.com/2026/11/04/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack/
  • DreamHost, "October Security Incident" (official notice, updated October 29, 2026): https://www.dreamhost.com/news/announcements/october-security-incident/