Hosting provider breach: due diligence after DreamHost

A hosting provider breach is no longer a remote risk that sits with the vendor alone. DreamHost confirmed that attackers sat inside its web-based File Manager from about August 2026 until the intrusion was discovered on October 23, 2026, taking FTP/SFTP usernames and passwords (BleepingComputer). The company put the affected share at well under 10% of email and FTP/SFTP accounts (DreamHost). For anyone whose site, storefront or inbox sits on rented infrastructure, that is a supply chain event with your name on the customer-facing side.

The timeline is the part procurement teams should study. Detection took roughly two months, and the public learned of it through breach notices. Black Kite's 2026 report found attacks are detected in a median of 10 days, yet the public is often left in the dark for an average of 117 days — a gap it calls the "Silent Window" (Black Kite). Your contract, not your vendor's status page, decides how fast you hear about a hosting provider breach.

What the DreamHost incident actually exposed

Attackers exploited a vulnerability in third-party software behind files.dreamhost.com, the browser tool customers use to edit site files. Anyone who logged in between roughly August 2026 and October 23, 2026 should treat those credentials as compromised (DreamHost). Some webmail accounts were also reached, and in a small number of cases mailbox contents may have been viewed.

The stolen material was not just passwords. DreamHost's filing with California's attorney general says session information — the data that keeps a user signed in, including session credentials — may have been exposed for a limited number of webmail users (California OAG). A password reset does not always kill a live session, which is why the vendor ended active sessions and invalidated passwords the same day.

DreamHost said it found no evidence that control panel logins or billing details were accessed, and it does not store full card numbers; card payments run through a third-party processor (DreamHost). That is a useful design point: payment data was out of scope because it was never held. Ask every hosting or managed infrastructure vendor the same question — what do you store that you could simply not store?

Why a hosting provider breach lands on the buyer

The attacker did not need anything exotic. Compromised hosting panel credentials are a traded commodity. Flare's analysis of around 200,000 underground forum posts found credentials sold in bulk, with tiers of pricing and plug-and-play listings that let low-skill actors take over sites, plant payloads and host phishing pages on reputable domains (Daily Security Review). A stolen FTP login is a ready-made entry point.

The blast radius rarely stops at the breached vendor. Black Kite verified that every vendor breach in 2025 claimed an average of 5.28 downstream companies, the highest level recorded (Black Kite). Those downstream names often stay private: a vendor can say it notified 5,000 customers while none of them are ever publicly identified.

Credentials remain the cheapest way in. A Lunar survey found 85% of organisations rank stolen credentials as a high or very high risk, yet only 32% use dedicated credential monitoring tools (BleepingComputer). Many buyers assume MFA and endpoint tooling cover them, even when staff log into hosting panels from unmanaged devices.

The contract clauses to insist on

Security questionnaires age quickly. Contract language does not. Before you sign a hosting, managed services or web development agreement, get the following in writing.

• Breach notification window. A fixed number of hours from confirmed discovery, not from the completion of a forensic report. Name the recipient role, not a generic support address.
• Credential rotation duty. Who resets what, within how long, and who pays for the incident response and forced rotation work.
• Session invalidation. A duty to terminate active sessions, not only change passwords, when tokens or session data may be exposed.
• Access control evidence. Logging and review of file manager, control panel and FTP/SFTP access, with the ability to show you the records.
• Subprocessor notice. The right to be told when a new subcontractor touches your data, and to object.
• Audit and remediation rights. Access to relevant evidence after an incident and a timeline for fixes, with remedies if they slip.
• Notification costs. Who funds credit monitoring, regulator filings and customer communications.

Vendor security posture is worth checking before any of this is negotiated. Start with Scopelyst's directory of cybersecurity vendors and use the 12 questions to ask an IT services vendor as a screen for firms that will hold your credentials.

How to run due diligence on hosting vendors

Treat the hosting layer as critical infrastructure, because it is. A short, repeatable process beats a one-off review.

1. 1Map what the vendor can reach. List every site, mailbox, database and DNS record under the account, and which of your staff hold admin rights.
2. 2Ask how the vendor separates access. Shared panels, single administrator logins and email-based resets are warning signs.
3. 3Require MFA on all administrative access. Press for evidence it is enforced, not merely available.
4. 4Test the notification path. Ask for a redacted copy of a past breach notice and the internal escalation timeline.
5. 5Check the disclosure record. Look at regulator filings and public notices, not just the vendor's own status posts.
6. 6Agree exit terms. Guaranteed export of files, mail and DNS records, so a switch is possible under pressure.
7. 7Re-review annually. Hosting products change; the contract and the controls should keep pace.

Where a vendor bundles web development with hosting, the same rules apply to the agency. Their developers hold the file manager keys.

What to do if your provider is breached

Assume compromise until the vendor gives you evidence otherwise. DreamHost told recipients to check website files for unauthorised changes, review webmail forwarding rules and filters, and change passwords on any other service using the same credentials (BleepingComputer). Copy that list into your own incident runbook.

Start with the inbox. Forwarding rules and filters are quiet persistence mechanisms: they keep delivering copies of mail after a password reset. Then audit the website files for injected code, redirects or new admin users. Then look outward — every account that reused the exposed password, on any platform.

Document everything from the moment you learn of it. Timestamps, actions, who you told. If a regulator, customer or insurer asks later, that record is your defence.

How hosting and infrastructure vendors should respond

Vendors selling hosting, managed infrastructure or web development will be asked these questions in their next RFP. Answer them before you are asked.

• Publish a breach notification commitment with a stated hour count, and hold to it.
• Show that session invalidation and forced credential rotation are standard playbook steps, not one-offs.
• Offer evidence of file manager and control panel access logging as a standard feature, not an enterprise upsell.
• Write subprocessor and notification-cost terms into your standard contract rather than negotiating them line by line.
• Describe your exit and data export process plainly. It builds trust and shortens sales cycles.

Vendors who put these commitments in writing separate themselves from firms that only send a security questionnaire. Our guide to winning RFPs on a marketplace without racing to the bottom explains how that evidence carries a proposal.

Frequently asked questions

What is a hosting provider breach?

It is a security incident at a company that hosts websites, email or infrastructure on your behalf, where an attacker gains access to customer accounts or data. DreamHost's 2026 incident exposed FTP/SFTP credentials and some webmail sessions after attackers exploited a flaw in its file manager software.

How quickly must a hosting provider notify me of a breach?

That depends on your contract and local law, not on the vendor's preference. DreamHost said it was notifying applicable regulators as required by law and would send formal notices in the coming days. Push for a fixed hour count from confirmed discovery in your agreement.

Does changing my password fix a credential exposure?

Not always. If session tokens were stolen, an attacker can stay signed in after a reset, which is why providers end active sessions as well. Review forwarding rules, filters and file changes too, since attackers often leave quiet persistence behind.

Should I ask about subprocessors in hosting contracts?

Yes. The DreamHost intrusion came through third-party software behind its file manager, which is exactly the kind of dependency you want disclosed. Ask for a subprocessor list, notice of changes and a right to object.

What this means for buyers

Run a short audit this month. List every hosting, email and managed infrastructure provider your business depends on, then rank them by what they can reach — admin panels and DNS first, marketing sites last.

For each one, pull the contract and check three things: a notification window in hours, a credential and session rotation duty, and evidence of access logging. Where any of the three is missing, open a conversation now rather than during an incident.

Then test your own side. Enforce MFA on administrative accounts, remove unused FTP and panel logins, and stop recycling passwords across hosting and personal accounts. If you need a specialist to help, shortlist firms through Scopelyst's vendor directory and post your project with the contract terms you want reviewed. The cheapest time to fix a hosting provider breach clause is before the breach.