DreamHost data breach investigation (File Manager FTP logins and webmail, 2026)

DreamHost, a web hosting company used by hundreds of thousands of website owners, says a hacker broke into the server behind its online File Manager and could see the FTP and SFTP logins of customers who used it between about August 2026 and October 23, 2026. The attacker also reached some webmail systems.

DreamHost says the contents of some customers' email and website files may also have been accessed. It is offering one year of free Equifax credit monitoring to people it notified.

At least one law firm, Shamis & Gentile, says it is investigating possible class action claims. Class Action Pulse found no filed lawsuit as of November 5, 2026. There is no settlement, payment or claim form.

DreamHost, LLC is a web hosting and domain registration company that has operated since 1997. Its company page lists a mailing address in Brea, California, and says it serves more than 400,000 customers in more than 100 countries and hosts more than 1.5 million websites. Its chief executive is Michael Rodriguez.

DreamHost's File Manager, at files.dreamhost.com, is a browser tool customers use to upload and edit website files. DreamHost says it was built on third-party software.

Affected customers are people who logged into File Manager during the affected period, and a smaller group of webmail users, according to DreamHost's notice.

Investigating law firms include Shamis & Gentile, P.A., according to ClaimDepot. A law firm investigation is advertising and does not mean a case has been filed.

According to DreamHost's notice letter, its public announcement and news reports:

• About August 2026: An unauthorized third party gained access to the File Manager server by exploiting a vulnerability in its software. DreamHost's filing with the California Attorney General lists August 15, 2026 as the breach date.
• October 23, 2026: DreamHost discovered the access, took File Manager offline and began resetting passwords for affected email and FTP or SFTP users.
• October 24 to 27, 2026: Help Net Security reported that password resets were complete by October 24. File Manager returned on October 26, and DreamHost marked the incident resolved on October 27.
• October 29, 2026: DreamHost published a security incident announcement.
• Early November 2026: DreamHost filed a sample notice letter with the California Attorney General and began notifying customers.

The notice says the attacker could see FTP and SFTP usernames and passwords for people who logged into File Manager during the affected window. It says the attacker also reached certain webmail systems and may have exposed session information, which keeps a user signed in, for a limited number of webmail users.

DreamHost says it found no evidence that control panel logins or billing details were accessed. It says it does not store full payment card numbers.

DreamHost says it believes this was a deliberate attack and that its team worked to contain it. It says it stopped the access, fixed the vulnerability, ended active sessions, reset passwords and added security measures. It also says it is working with outside legal advisors and forensics experts.

DreamHost has not said exactly how many customers were affected. Its announcement says the number is "well under approximately 10%" of email and FTP or SFTP accounts. A spokesperson declined to give TechCrunch an exact figure or explain why the access was not caught sooner. The company told TechCrunch the incident was not related to PHP vulnerabilities.

Investigating lawyers say they are looking at whether DreamHost failed to protect customer data. These are not claims in any court.

Class Action Pulse is not aware of any DreamHost statement about possible litigation.

No court is involved yet. Class Action Pulse found no lawsuit against DreamHost over this incident as of November 5, 2026.

Nothing has been decided about whether DreamHost was careless, whether customers were harmed or whether anyone is owed money.

There is no class. Based on DreamHost's notice, people who may later be affected by a lawsuit include:

• Notice: You received a DreamHost Notice of Data Breach letter or email.
• File Manager users: You logged into File Manager at files.dreamhost.com between about August 2026 and October 23, 2026.
• Webmail users: DreamHost told you your webmail session or mailbox may have been involved.
• Password reset: DreamHost reset your email, FTP or SFTP password in late October 2026.

If a lawsuit is filed, the class definition in the complaint would control.

1. Enroll in monitoring. DreamHost's letter includes an activation code for Equifax Credit Watch Gold. Enroll at equifax.com/activate before the deadline printed in your letter.
2. Change reused passwords. If you used the same password anywhere else, change it now.
3. Check your email settings. DreamHost recommends looking for unexpected forwarding rules or filters.
4. Review your website files. Look for files you did not upload or changes you did not make.
5. Think about what was stored. If your email or website files held passwords, customer data or financial details, review those accounts too.
6. Get help. DreamHost says to use its support form at dreamhost.com/support and pick "Account security." It says it will never ask for your password by email.

You can also get free credit reports at annualcreditreport.com and report identity theft at IdentityTheft.gov.

DreamHost is offering one year of Equifax Credit Watch Gold. The sample letter says it includes credit monitoring, daily access to an Equifax credit report, alerts if personal details turn up on fraudulent internet trading sites, identity restoration help and up to $1 million in identity theft insurance for certain costs.

There is no cash payment, settlement or claim deadline. Any money would require a lawsuit and a court-approved settlement or judgment.

• August 15, 2026: Breach date listed with the California Attorney General.
• October 23, 2026: DreamHost discovered the access.
• October 29, 2026: DreamHost announced the incident.
• Early November 2026: Customer notices began.

The Equifax enrollment deadline is printed in each letter. Class Action Pulse has not seen the date because the public sample uses a placeholder. Data breach claims can have filing time limits that vary by state, so talk to a lawyer if you want to protect your rights.

FTP and SFTP: Ways of moving files to and from a web server. SFTP is the encrypted version.

Session information: Data that keeps you logged in, so you do not have to enter your password again. Someone with it may be able to act as you until the session ends.

Credit monitoring: A service that alerts you to changes in your credit file, such as a new account.

Class action investigation: A law firm's review of whether to file a lawsuit for a group of people.

DreamHost says its investigation is ongoing and that it will share significant new information. More state attorney general filings may show how many people were notified.

If a law firm files a lawsuit, it would name plaintiffs and propose a class. A court would later decide whether the case can go forward as a class action. Class Action Pulse will update this page if a case is filed.

This article relies on DreamHost's sample notice letter filed with the California Attorney General, the Attorney General's listing, DreamHost's company page and announcement, and reports from TechCrunch, BleepingComputer and Help Net Security.

DreamHost has not published a total number of people affected. The exact start date of the access is unclear: the letter says about August 2026, and the state listing says August 15, 2026. The law firm investigation is reported by ClaimDepot. The recovery dates in late October come from news reports.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.