Is DreamHost Safe After the File Manager Breach? What to Do Now
By Ashikur Rahman15 min readQuick answer: DreamHost is still safe to use for most customers, but the October 2026 breach was real and you should act if it touched your account. On 23 October DreamHost found that an attacker had exploited third-party software behind its browser-based File Manager and taken the FTP/SFTP usernames and passwords of people who logged into it between about August and 23 October 2026, plus some webmail logins. DreamHost says well under 10% of email and FTP/SFTP accounts were affected, and that it found no evidence of access to control panel logins or billing details. If you used File Manager in that window, change those passwords, check your site files and your mail forwarding rules today. Moving hosts is a choice, not a requirement, and it does not undo anything that was already exposed.
What happened at DreamHost?
DreamHost published a full account on 29 October 2026 under the title "October Security Incident". It reads: "On the afternoon of Friday, October 23, we discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com." The company took the File Manager servers offline, fixed the hole and started an investigation the same day.
The File Manager is the tool you use in a browser to upload, edit and delete the files on your website without an FTP program. DreamHost describes it as "a browser-based tool, built on third-party software". That third-party software is where the weakness was: "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of users who logged into this File Manager before the activity was detected on October 23, 2026."
The attacker also reached further. DreamHost says it "was also able to reach certain webmail systems and obtain the login credentials of a limited number of webmail users." In "a small number of cases", DreamHost says it believes the attacker "may have used those credentials to view mailbox contents", and it says it is contacting those customers one by one. It calls the incident "a deliberate attack".
DreamHost has not named the third-party software or the vulnerability, and it has not said who the attacker was. It has also not published an exact count of affected accounts. Its notice says it is notifying regulators, and BleepingComputer reported on 4 November that DreamHost's breach letter offers affected people one year of credit monitoring and identity theft protection through Equifax.
| Date (2026) | What happened | Source |
|---|---|---|
| About August | Exposure window begins for people logging into File Manager | DreamHost notice |
| 23 October | Attack discovered; File Manager taken offline; passwords reset for email and FTP/SFTP users that might be affected | DreamHost notice |
| 26 October | Rebuilt File Manager back online | webhosting.today |
| 27 October | Incident marked resolved on DreamHost's status page | webhosting.today |
| 29 October | Full incident notice published | DreamHost notice |
| Early November | Breach letters with Equifax monitoring offer reported | BleepingComputer |
Were you affected by the DreamHost breach?
DreamHost gives two tests in its notice. You may be affected if:
- You, or an FTP/SFTP user on your account, logged into File Manager between approximately August 2026 and 23 October 2026. DreamHost's instruction is direct: "Please treat those usernames and passwords as compromised."
- An email user on your account was signed out and the old password stopped working on or after 23 October. DreamHost says: "That was us." It reset the passwords of mailboxes it believed "could have been affected" while it investigated.
DreamHost also says the second group was cast wide on purpose. Its notice adds that "not everyone who received that initial email from us was affected, and fewer customers are known to be affected at this time than originally suspected." Getting a reset email does not prove your data was taken; it means DreamHost could not rule it out at the time.
There is a useful reverse test as well: "If a previously-working password on an email or FTP/SFTP account still works and you have not changed it yourself, our investigation to date indicates that it was not exposed in this incident." If nothing was reset and you never used File Manager in the window, you are very likely outside the affected group, although DreamHost still suggests changing passwords as a precaution.
Who the account holder has to tell
BleepingComputer reported that DreamHost said it "cannot contact individual mailbox or FTP users directly". If you run a DreamHost account with mailboxes or FTP users for staff or clients, DreamHost emailed you, not them. A colleague whose mailbox password stopped working may not know why. Tell them by phone or text, because their email may be the thing that is locked.
Disclosure: The Hostinger links and buttons on this page are referral links, and CriticNest earns a commission if you buy through one, at no extra cost to you. CriticNest has no relationship with DreamHost. The commission does not change the advice below, which is that most DreamHost customers can fix this without moving. Every DreamHost quotation comes from its own incident notice, and every Hostinger price was read on Hostinger's site on 10 November 2026 in US dollars. Ashikur Rahman, who writes CriticNest, is a Hostinger Partner through his agency Proximity Ranker, and the Hostinger links in this article use his referral code, 9MFASHIKUSCB, which also works as a coupon code at Hostinger checkout.
What was exposed, and what was not
Here is the split, using only what DreamHost has said in its notice.
| Item | Exposed? | DreamHost's words |
|---|---|---|
| FTP/SFTP usernames and passwords of File Manager users | Yes, for logins in the window | "treat those usernames and passwords as compromised" |
| Some webmail logins | Yes, a limited number | "obtain the login credentials of a limited number of webmail users" |
| Mailbox contents | Possibly, in a small number of cases | "may have used those credentials to view mailbox contents" |
| Control panel logins | No evidence | "no evidence that the unauthorized third party accessed control panel logins" |
| Billing details | No evidence | "or customer billing details" |
| Full card numbers | Not held by DreamHost | "DreamHost does not store full payment card numbers" |
| Websites and email delivery | Stayed online | "Your websites and email have remained available throughout this incident" |
Two points in that table deserve more weight than they get in the headlines. First, an FTP password is not just a login. Whoever holds it can upload, change or delete files on your website, which means they can plant malware or a spam page if they used it before the reset. Second, a webmail login that was used to read a mailbox may have exposed password reset emails for other services. Both are reasons to look, not just to change a password and move on.
Compare Hostinger's web hosting plansReferral link. Coupon code 9MFASHIKUSCB. Fix your DreamHost passwords first, whatever you decide.
What to do right now if you use DreamHost
Work through these in order. Most come straight from DreamHost's notice; the reasons attached to them follow from what an attacker could do with what was taken.
- Reset every affected password from the control panel. DreamHost says "only the DreamHost account holder can set new passwords from inside the DreamHost account control panel," and that "a changed password may take up to 15 minutes to take effect." Type panel.dreamhost.com into your browser yourself; DreamHost recommends that rather than clicking links.
- Change the same password everywhere else you used it. DreamHost: "If you use the same or a similar password for any other account or service, we recommend changing it there as well." A reused FTP password is a key to every other door it opens.
- Update saved passwords in your apps. "Update any email, FTP, or SFTP clients that have the old passwords saved." Otherwise your phone's mail app will keep failing, and an old FTP client may lock the account with repeated bad logins.
- Check your website files. DreamHost's advice is to "Look over your website files for any changes you don't recognize." Sort by last-modified date and look at anything changed between August and 23 October that you did not change yourself, especially new PHP files and edits to index or theme files.
- Check webmail forwarding rules and filters. "Check your webmail settings, especially forwarding rules and filters, for anything you didn't set up yourself." A hidden rule that forwards copies of your mail elsewhere is a classic way to keep reading a mailbox after the password changes.
- Watch for fake DreamHost emails. "DreamHost will never email you asking for your password," and its incident emails "will never ask you to sign in through a link." Any message that does either is phishing that copies the real notice.
- Take the Equifax offer if you get a letter. If DreamHost's breach letter reaches you, the year of credit monitoring and identity theft protection reported by BleepingComputer costs you nothing.
- If you hold other people's data, ask a lawyer. DreamHost says customers who store data about their own clients "may wish to consult your own legal advisors about any additional obligations you may have regarding this incident."
Is DreamHost safe to keep using?
On the evidence published so far, yes for most customers, with clear eyes about what went wrong. The breach came through third-party software behind one tool, not through the hosting servers your sites run on, and DreamHost says websites and email stayed up throughout. It found the attack, took the tool offline the same day, reset passwords, rebuilt File Manager "with additional security precautions and enhanced monitoring," rotated internal credentials, brought in outside forensics experts and says it is reviewing other customer-facing tools for similar weaknesses. That is the standard checklist for a credible response.
The weaker points are about time and detail. The exposure window ran from about August to 23 October, roughly two and a half months before anyone noticed. DreamHost has not named the software or the vulnerability, has not given an exact number of affected accounts, and its first wave of reset emails reached more people than turned out to be affected. Customers quoted by BleepingComputer complained about the lack of information in the first days. None of that makes DreamHost unsafe today, but it is fair to weigh.
DreamHost is a large host. BleepingComputer describes it as serving "over 400,000 customers in more than 100 countries" and at least 1.5 million websites and applications. Its notice also states the incident "was not related to recent PHP server updates," which it says were patched "within hours", with its firewall blocking "tens of thousands of intrusion attempts" before the patches shipped. TechRadar notes earlier incidents too: a 2012 database server breach that exposed FTP and shell passwords, and a 2017 DDoS attack on its DNS.
The practical test
Ask yourself three questions. Did you use File Manager? Do you reuse passwords? Does your site hold customer data? If the answers are no, no and no, a password change and a file check is the whole job, and staying is reasonable. If you answer yes to the last one, the decision is bigger than which host is cheaper, and it belongs with whoever is responsible for that data.
Should you switch hosts after the breach?
Switching makes sense for some customers and not for others. It is worth being clear about what a move does and does not do.
What moving does not do: it does not undo the exposure. If your FTP password was taken in September, a new host in November does not change that. The steps above still have to happen first: new passwords, a file check, a look at mail rules. Moving a site that already carries a planted file simply carries the file to the new host.
When moving is reasonable: if this incident has broken your trust and you were already unhappy with speed, support or price; if you run client sites and your clients are asking questions you cannot answer; or if your renewal is coming up anyway. In those cases, a breach is a sensible moment to compare, because you are already touching every password.
When staying is reasonable: if you did not use File Manager, your passwords were never reset, and your site has been fine. Every host carries risk, and a host that has just been through a forensic review and rebuilt the tool that failed is not obviously riskier than one that has not been tested.
If you are choosing a new host, our guide to the best hosting for WordPress beginners covers what to look for, and our Hostinger vs Bluehost comparison sets two of the common alternatives side by side.
See Hostinger's Black Friday hosting dealsReferral link. Coupon code 9MFASHIKUSCB. The sale runs to 14 December 2026.
What moving to another host involves
If you decide to move, the cost is not only the new plan. It is the time to copy files, databases and email, and to change DNS. Most hosts now offer to do much of that for you. Hostinger is one example, and its terms are typical of what to check.
Hostinger's web hosting FAQ, read on 10 November 2026, says: "Yes, we offer free unlimited website migration with no downtime." The process is to "buy one of our hosting plans first. After that, access hPanel to submit a request for automatic website migration or manually transfer your website's files." For sites that are not on a typical CMS such as WordPress, it says its "Customer Success team will guide you through the process at no additional cost." Its plans carry a "30-day money-back guarantee".
| Hostinger plan, 48 months | Pay today | Per month in the sale | Renewal on the plan card |
|---|---|---|---|
| Premium | $95.52 | $1.99 | $10.99 a month |
| Unlimited | $133.92 | $2.79 | $16.99 a month |
| Cloud Startup | $383.52 | $7.99 | $25.99 a month |
Those are the prices Hostinger's web hosting page showed on 10 November 2026 during its Black Friday sale, and they match what its checkout showed on 6 November. Read the renewal line before you pay: the Premium card says it "Renews at $10.99/mo for the same term", but on 6 November the checkout said the Premium renewal ran "for 12 months", so the cart, not the card, is the figure to trust. Across five years on the 48-month Premium term, the first term plus one renewal year comes to $227.40. Our guide to Hostinger's Black Friday 2026 sale has the full term-by-term breakdown.
Whichever host you choose, three things matter more than the price: that it supports SFTP rather than plain FTP, that you can turn on two-factor authentication for the control panel, and that it gives you daily backups you can restore yourself. A breach at any host is easier to recover from with a clean backup from before it started.
What to move, and in which order
- Change your DreamHost passwords and check your files first, so you move a clean copy.
- Take a full backup of files and databases yourself, even if the new host migrates for you.
- Move email last, and only after you have checked forwarding rules on the old mailboxes.
- Keep the old account running until DNS has switched and you have confirmed the new site and mail work.
How to protect a website on any host
The DreamHost breach is a reminder of a few habits that limit the damage of the next incident, wherever you host.
Use a different password for every account. DreamHost's notice asks for "strong, unique passwords for every user on your DreamHost account." The only practical way to do that is a password manager. Our comparison of whether Bitwarden is as secure as 1Password covers two of the main options. A unique FTP password means a stolen one opens one door, not ten.
Prefer SFTP and SSH keys over browser tools. Browser-based file managers are convenient, and this one was the entry point. Where your host supports it, connect with an SFTP client, and use key-based logins rather than passwords if the host allows them.
Give each person their own login. If a contractor needs FTP access, create a separate user and delete it when the job ends. Shared logins mean that when one is exposed, you cannot tell who did what.
Watch your files and your mail rules. Plugins and host tools that alert you to changed files catch planted code early. Check mailbox forwarding rules now and then, not only after a breach.
Keep backups off the server. A backup stored on the same account an attacker can reach is not much of a backup. Keep at least one copy somewhere else.
Check Hostinger's free migration and plansReferral link. Coupon code 9MFASHIKUSCB. Read the renewal line in the cart before you pay.
The short version
DreamHost's File Manager was breached through third-party software, exposing FTP/SFTP passwords for people who used it between about August and 23 October 2026, and some webmail logins. DreamHost says well under 10% of email and FTP/SFTP accounts were affected, with no evidence of access to control panel logins or billing details, and that sites and email stayed online. If you used File Manager in that window, change those passwords and any reused copies, check your site files and mail forwarding rules, and ignore any email asking for your password. DreamHost's response was the standard one done promptly; the long exposure window and thin detail are the fair criticisms. Moving hosts is an option if you have other reasons to leave, but it fixes nothing on its own.
Frequently asked questions
Is DreamHost safe after the October 2026 breach?
For most customers, yes. The breach came through third-party software behind DreamHost's File Manager, not the servers that host websites, and DreamHost says it found no evidence of access to control panel logins or billing details. If you used File Manager between about August and 23 October 2026, treat those FTP/SFTP passwords as compromised and change them.
What was stolen in the DreamHost breach?
FTP/SFTP usernames and passwords of people who logged into File Manager before 23 October 2026, and the login credentials of a limited number of webmail users. DreamHost believes a small number of mailboxes may have been viewed and says it is contacting those customers individually.
How do I know if my DreamHost account was affected?
DreamHost says you may be affected if you or an FTP/SFTP user on your account logged into File Manager between approximately August 2026 and 23 October 2026, or if an email user's password stopped working on or after 23 October. If a password still works and you did not change it, DreamHost says it was not exposed.
Was my credit card exposed at DreamHost?
DreamHost says it has found no evidence that the attacker accessed customer billing details, and that it "does not store full payment card numbers"; card payments are handled by a third-party payment processor. You can still review your statements as a precaution.
Did my website go down during the DreamHost incident?
DreamHost says websites and email remained available throughout, and that inboxes kept receiving mail whether or not passwords had been reset. What stopped working was sign-in for mailboxes and FTP/SFTP users whose passwords DreamHost reset, until the account holder set new ones.
Why can't my staff reset their own DreamHost email password?
DreamHost says only the account holder can set new passwords for mail, FTP and SFTP users from the DreamHost control panel. It also cannot contact individual mailbox users directly, so the account holder needs to reset the password and tell each person by phone or text.
Is DreamHost offering credit monitoring?
BleepingComputer reported that DreamHost's breach letter offers affected individuals one year of credit monitoring and identity theft protection through Equifax. Look for the letter if you were notified, and enrol from the details in it rather than from an unexpected email link.
Should I move my website away from DreamHost?
Only if you have reasons beyond this incident, such as price, speed, support or client pressure. Moving does not undo exposed passwords or planted files, so reset passwords and check your site first. If you do move, compare migration help, renewal prices, SFTP support and backups.
Has DreamHost been hacked before?
TechRadar recalls a 2012 incident in which attackers reached one of DreamHost's database servers and potentially exposed FTP and shell passwords, and a 2017 DDoS attack against its DNS that caused widespread connectivity problems. Neither involved the File Manager, which was the entry point in October 2026.
How do I spot a fake DreamHost breach email?
DreamHost says it will never email you asking for your password, and its incident emails will never ask you to sign in through a link. Type panel.dreamhost.com into your browser yourself to change passwords, and treat any email that asks for a password or a link sign-in as phishing.
