Almeida Law Group is investigating a data breach at DreamHost. If you were affected, contact Almeida Law Group.
About DreamHost
DreamHost (DreamHost, LLC) is an American web hosting provider, domain registrar, and cloud services company founded in 1997. It is a private, employee-owned company based in Los Angeles, California, serving over 400,000 customers with services including shared hosting, VPS, dedicated servers, managed WordPress hosting, email hosting, and domain registration. Because DreamHost stores login credentials and manages file systems on behalf of its customers, a breach exposing those credentials carries meaningful downstream risk for website owners and their own end users.
What Happened?
DreamHost was listed in a Vermont Attorney General breach report summary dated November 4th, 2026, with login credentials identified as the category of data involved.
According to supplemental reporting, an unauthorized third party exploited a vulnerability in DreamHost’s web-based File Manager at files.dreamhost.com and maintained access from approximately August 2026 through October 23rd, 2026, when the intrusion was discovered. The stolen data includes FTP/SFTP usernames and passwords. The attacker may also have accessed webmail systems, exposing session information including credentials for a limited number of users. DreamHost stated it found no evidence that control panel login information or customer billing and payment details were accessed. The company estimates that well under 10% of its approximately 400,000 customers were affected.
In response, DreamHost blocked the attacker’s access, patched the vulnerability, took the affected File Manager server offline for forensic analysis, reset affected passwords, and ended active sessions. DreamHost is offering one year of free credit monitoring and identity theft protection through Equifax. The incident was also reported to the California Attorney General. As of November 2026, at least two law firms — Shamis & Gentile P.A. and Strauss Borrelli PLLC — have announced investigations into a potential class action lawsuit, though no filed lawsuit has been confirmed. DreamHost experienced a prior breach in January 2012, when a hacker accessed a database containing unencrypted FTP/shell passwords — a notably similar incident to the current one.
Key Facts at a Glance
- Company or Organization: DreamHost (DreamHost, LLC)
- Industry: Web Hosting / Internet Infrastructure / Domain Registration
- Location: Los Angeles, California, USA
- Incident type: Unauthorized access via vulnerability in web-based File Manager
- Date of breach: Approximately August 15th, 2026
- Date breach discovered: October 23rd, 2026
- Date of consumer notification: November 4th, 2026
- Identity theft protection offered: One year of free credit monitoring and identity theft protection through Equifax
- Prior breach: January 2012 breach involving unencrypted FTP/shell passwords
- Litigation status: Law firm investigations announced by Shamis & Gentile P.A. and Strauss Borrelli PLLC; no filed class action confirmed as of November 2026
- Source: Vermont Attorney General breach report; BleepingComputer; Strauss Borrelli investigation
What Should You Do?
If you received a notification from DreamHost, enroll in the free Equifax credit monitoring and identity theft protection being offered before the deadline stated in your notice. Change any FTP, SFTP, or webmail passwords associated with your DreamHost account, and update those credentials anywhere else you may have reused them. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your financial accounts for any suspicious activity. You can obtain free annual credit reports at AnnualCreditReport.com. If you experience signs of identity theft, report them and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
