DFX Intelligence

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

DreamHost

Cloud, identity and critical software · National

Monitoring

Not directly monitored. Shown from research findings only.

Public findings

Provider status posts on record

Cyber and operational findings

Analyst-reviewed records. The grade states how well the cause is established; event, first public observation and acknowledgement are separate dates.

A ConfirmedStatus: ongoing

In-window notice (29 Oct): vulnerability addressed, File Manager rebuilt with monitoring, internal credentials rotated, outside forensics retained, affected server preserved, regulators being notified.

Event: Aug 15

First public: Oct 23

Third-party report: unknown

Acknowledged: Oct 23

Aug 15 · DIS
DreamHost, LLC listed on California AG breach list, reported 2 Nov 2026, breach date 15 Aug 2026 (consistent with exposure window Aug to 23 Oct).
Source
2026-08-15 (AG); 2026-10-23 (reset event) · DIS
CA AG posting 11/02/2026 with breach date 08/15/2026; Vermont AG posting 11-4-2026 (57 VT residents). Separately, DreamHost forced email and FTP/SFTP password resets after a File Manager and webmail disruption that began 2026-10-23 (pre-window; File Manager...
Source
Oct 29 · REM
In-window notice (29 Oct): vulnerability addressed, File Manager rebuilt with monitoring, internal credentials rotated, outside forensics retained, affected server preserved, regulators being notified.
Source

Provider status posts

Collected from the organisation's own public status page. These are its words; DFX adds only the wording classification.

No status posts collected for this organisation.

Documented dependents

Organisations publicly documented as relying on this provider. A relationship is not an impact.

DreamHost

verified

Under about 10% of DreamHost email and FTP/SFTP accountsNo confirmed impact