DreamHost Data Breach Exposes Passwords and Email Contents

DreamHost LLC, a web hosting and domain-registration company, disclosed a data breach that occurred between August and October 2026. The company provides website hosting, managed WordPress hosting, cloud services, email and domain registration for individuals, developers and businesses.

The breach was reported to the California Attorney General on Nov. 2, 2026. DreamHost notified affected consumers by written notice. The total number of individuals affected was not disclosed in the regulatory filing.

Between August 2026 and Oct. 23, 2026, an unauthorized third party gained access to the server that runs DreamHost's web-based File Manager, located at files.dreamhost.com.

Once inside, the unauthorized third party was able to access the FTP/SFTP usernames and passwords of individuals who had logged into the File Manager during that time period.

The attacker also reached certain webmail systems hosted by DreamHost. This may have exposed session information for a number of webmail users. With access to this data, an attacker could potentially view email without needing to know a user's password.

The types of information exposed in the breach included usernames, passwords, email contents and files stored on FTP/SFTP servers.

DreamHost's response to the breach

DreamHost is offering affected individuals one year of identity theft protection services through Equifax Credit Watch Gold at no cost. Affected individuals can enroll at Equifax's activation page using the unique activation code included in their notification letter.

For additional assistance, affected individuals can visit DreamHost's support page and select "Account security" as the topic.