DreamHost discloses File Manager breach affecting FTP/SFTP and webmail credentials

What the notice says

DreamHost, LLC filed a notice with the California Attorney General, reported 2026-11-02, informing customers of a data security incident involving its web-based File Manager service. The notice states that DreamHost became aware an unauthorized third party had accessed the server that runs its web-based File Manager at files.dreamhost.com. According to the notice, the exposed information could include the username and password used to access the File Manager or webmail, and in some cases, the contents of email and files on the FTP/SFTP server.

DreamHost states that the unauthorized party reached certain systems between approximately August 2026 and October 23, 2026. The notice also describes exposure, for a limited number of webmail users, of session information — the data that keeps a user signed in, including session credentials. DreamHost says it terminated active sessions of users who may have been affected, reset their passwords, and implemented additional security measures designed to prevent a recurrence of such an attack. The notice as filed also states that DreamHost found no evidence that the unauthorized third party accessed control panel login information or customer billing details, and that the company does not store full payment card numbers.

What the notice leaves open

The notice as filed does not state a specific total number of individuals affected nationwide, though it references a placeholder figure for Rhode Island residents. It does not specify how the vulnerability in the File Manager software was introduced or identify the unauthorized third party. The notice does not describe the full scope of email or file content that may have been viewed, stating only that its investigation is ongoing and that updates will follow if significant new information is found.