DreamHost customers who logged into the web host’s File Manager, and a limited number of its webmail users, received notice of a breach that exposed FTP/SFTP usernames and passwords and some webmail sessions between about August and October 23, 2026. No lawsuit or settlement has been reported, so there is nothing to claim; DreamHost is offering one year of free credit monitoring.
What Happened?
Web hosting company DreamHost, LLC has begun notifying customers of a data security incident involving its web-based File Manager at files.dreamhost.com. According to the notice letter DreamHost filed with the California Attorney General on November 2, 2026, an unauthorized third party exploited a vulnerability in the File Manager software and reached the FTP/SFTP usernames and passwords of people who logged into the File Manager between about August 2026 and October 23, 2026. The California filing lists August 15, 2026 as the breach date.DreamHost says the attacker also reached certain webmail systems, which may have exposed the session information that keeps a user signed in, including session credentials, for a limited number of webmail users. The company calls it a deliberate attack. It has not publicly said how many customers were affected.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Involved?
The notice says the accessed data may include the username and password used for the File Manager or for webmail. DreamHost adds that the contents of customers’ emails and of the files stored on the FTP/SFTP server may also have been accessed. That matters because an FTP or SFTP login controls the files that make up a website, and a mailbox can hold account details, invoices and other personal information.DreamHost says its investigation so far has found no evidence that the attacker reached control panel login information or customer billing details. It says it does not store full payment card numbers: card payments run through a third-party processor, and DreamHost keeps only a token that cannot be used to make purchases elsewhere. The company says its investigation is ongoing and that it will update customers if it learns significant new information.
What DreamHost Says It Has Done
After discovering the intrusion, DreamHost says it cut off the attacker’s access, fixed the exploited vulnerability and worked to undo the effects of the unauthorized access. It ended active sessions for users who may have been affected and reset their passwords, added security measures meant to prevent a repeat, and brought in outside legal advisors and security and forensics experts.The letter offers affected customers one year of credit monitoring and identity theft protection at no cost. It also describes steps customers can take: reviewing website files for unexpected changes, checking email account settings such as forwarding rules and filters, and changing the password on any other account that used the same or a similar username and password. DreamHost notes that it will never ask for a password by email.
Is There a Lawsuit?
No class action over the DreamHost incident has been reported as of November 6, 2026, and there is no settlement or claim form. Breaches that expose login credentials often draw lawsuits in the weeks after notices go out; any filing would make claims of harm that DreamHost could contest, and none has been tested in court. OCA will update this page if a complaint is filed.Questions
What information was exposed in the DreamHost breach?
DreamHost says the attacker reached the FTP/SFTP usernames and passwords of people who logged into its web-based File Manager between about August 2026 and October 23, 2026, and the session information of a limited number of webmail users. It says the contents of emails and of files on the FTP/SFTP server may also have been accessed.
Were DreamHost billing or credit card details taken?
DreamHost says its investigation so far has found no evidence that control panel login information or customer billing details were accessed. It says it does not store full payment card numbers; a third-party processor handles card payments and DreamHost keeps only a token that cannot be used to make purchases elsewhere. The investigation is ongoing.
Is there a DreamHost data breach lawsuit or settlement?
No lawsuit or settlement over the DreamHost incident has been reported as of November 6, 2026, so there is nothing to claim. DreamHost is offering affected customers one year of free credit monitoring and identity theft protection, described in its notice letter.
What has DreamHost done in response?
DreamHost says it cut off the attacker’s access, fixed the exploited vulnerability, ended active sessions for users who may have been affected and reset their passwords. It says it added security measures and is working with outside legal advisors and security and forensics experts.
Why does an exposed FTP or webmail login matter?
An FTP or SFTP login controls the files that make up a website, and a webmail session can open the mailbox it belongs to. DreamHost’s letter warns that the contents of emails and website files may hold other information, and it lists checking website files for unexpected changes and mailbox settings such as forwarding rules among the steps customers can take.
Sources
• California Attorney General, Submitted Breach Notification Sample: DreamHost, LLC (reported November 2, 2026)• DreamHost, “Notice of Data Breach” customer letter (PDF, filed with the California Attorney General)
