DreamHost, a web hosting company and domain registrar, has confirmed a data breach. Attackers exploited a weakness in the server running its web-based File Manager, the tool customers use to manage website files in a browser. The intrusion lasted from August 2026 until it was discovered on October 23, 2026.
During that time, the attackers could capture the FTP and SFTP usernames and passwords of anyone who logged into the File Manager. FTP and SFTP are methods used to upload and change website files. DreamHost also says the intruder may have reached its webmail systems and exposed session information, including credentials, for a limited number of users.
DreamHost says it found no evidence that control panel logins or billing and payment details were accessed. The company has blocked the attackers, fixed the weakness, ended active sessions for possibly affected users and invalidated their passwords. Affected customers are being offered one year of credit monitoring and identity theft protection through Equifax.
For a small business, stolen website credentials could allow someone to alter your website, and webmail access could allow someone to quietly forward or filter your messages. If the same password was used elsewhere, other accounts could be at risk as well.
What you should do
- Check your website files for any changes you did not make, especially if you used DreamHost's File Manager.
- Review webmail forwarding rules and filters and delete any you do not recognize.
- Change passwords on any other accounts that used the same password as your DreamHost logins.
- Consider placing a fraud alert or security freeze on your credit report if you received a notice, and enroll in the offered monitoring.
- Ask Computech to help review your website and email settings for signs of tampering.
Computech prepares these summaries with AI assistance, based on public news reports. See the original report for full details.
