DreamHost has one number it will not give: how many of its customers were actually affected. What it will say is that an unauthorised third party was inside the server running its browser-based File Manager at files.dreamhost.com from roughly August 2026 until the afternoon of Friday, 23 October — the moment the company noticed.
That is more than two months of dwell time inside a login-adjacent tool, at a host that advertises around 400,000 paying customers. DreamHost calls it "a deliberate attack."
What was taken
Per the company's 29 October incident post:
- FTP/SFTP usernames and passwords for users who logged into the File Manager between roughly August and 23 October. The advice is blunt: "treat those usernames and passwords as compromised." - Webmail credentials for "a limited number" of mailbox users. Those passwords were reset and active sessions ended the same day. In "a small number of cases" DreamHost believes the intruder may have used them to read mailbox contents; those customers are being contacted individually. - The vector was a vulnerability in third-party software behind the File Manager. DreamHost has not named the software or the flaw. It says the incident was unrelated to the recent PHP server updates: its PHP servers were patched within hours, and its web application firewall blocked "tens of thousands" of intrusion attempts in the days before those patches shipped.
The company says it found no evidence that control panel logins or billing details were accessed, and that it does not store full payment card numbers.
The number nobody will pin down
DreamHost's scope estimate is "well under approximately 10%" of email and FTP/SFTP accounts — a ceiling, not a count. It also applies to accounts, not to the 400,000-customer figure the company markets, so even the ceiling does not map onto a customer number.
There is a second gap. In the breach notice filed with California's attorney general, the company described the attacker as obtaining session tokens — the credentials that keep a user logged in, which let an intruder act as that user without ever learning a password. Its public post describes stolen usernames and passwords. Both can be true at once; the difference has not been explained. A spokesperson declined to say why the intrusion went undetected for two months, citing the ongoing investigation.
Why an FTP password is worse than it sounds
An FTP/SFTP login is file-level write access to a hosted website. Whoever holds it can alter pages, inject scripts or redirects, and plant payloads that visitors will load. DreamHost's own guidance reads like a persistence checklist: "look over your website files for any changes you don't recognize" and "check your webmail settings, especially forwarding rules and filters, for anything you didn't set up yourself."
For a shared host, that is a supply-chain problem rather than a single-company problem. The sites running on those accounts belong to small businesses, clubs and campaigns that have no security team to notice an injected script.
Containment and the legal tail
The File Manager server was taken out of service and preserved for forensics; the tool was rebuilt with extra monitoring and returned on 26 October, and the incident was marked resolved on 27 October. DreamHost rotated internal credentials, retained outside forensics firms, is reviewing its other customer-facing tools for similar flaws, and is notifying regulators.
Password resets went out over the weekend of discovery, before the investigation had narrowed the population — the company now says not everyone who received the reset email was affected. On 4 November the law firm Strauss Borrelli announced it was investigating a potential class action, citing an incident date of 15 August.
The takeaway
The vulnerability is the ordinary part of this story. The extraordinary part is the dwell time: two months inside a file manager with nobody watching. A tool that handles credentials every day is exactly the tool whose access logs deserve an alert.
Customers who logged into DreamHost's File Manager between August and 23 October should rotate those FTP/SFTP passwords now, change any account that reused them, and audit site files and mail filters. DreamHost says it will never email asking for a password, and that its incident emails never ask users to sign in through a link.
