DreamHost, LLC, a web hosting and domain registration provider, reported a data security incident that occurred between August 15, 2026, and October 23, 2026. The incident involved unauthorized access to the server supporting DreamHost's browser-based File Manager at files.dreamhost.com, caused by a vulnerability in third-party software supporting the service. DreamHost discovered the activity on October 23, 2026, and submitted a formal data breach notification to the California Attorney General on November 2, 2026.
The exposed information included FTP and SFTP usernames and passwords, certain webmail credentials, session data, and files stored on affected FTP or SFTP servers. In a limited number of instances, email contents were also accessible. DreamHost stated there was no evidence that billing details or control-panel logins were compromised. The exact number of affected individuals has not been publicly released, though the company stated the breach impacted well under 10% of hosted email and FTP or SFTP accounts.
DreamHost initiated password resets for affected credentials and began issuing notices to account owners. As investigation and regulatory reporting processes proceed, additional details regarding the scope of the incident may be disclosed.