Your Hosting Provider Was Breached. Here Is What to Do in the Next Hour

It has been a busy fortnight for hosting security. DreamHost reset customer passwords for email and FTP access after a security incident. 123-Reg said an AI-driven attack scraped customer contact information. And developer platform Kernel published a detailed notice explaining how an attacker used a compromised API key and a hosting account credential to reach part of its infrastructure. When your provider emails to say it has been breached, the first hour matters more than the next month.

What has happened recently

Recent hosting and platform incidents (late October to early November 2026)

Provider	What was reported	Source
DreamHost	Customer passwords reset for email and FTP access after a security incident	Reported by Bleeping Computer, via a weekly security round-up
123-Reg	An AI-driven attack scraped customer contact information	Weekly security round-up
Kernel	A compromised API key and hosting credential gave access to servers; 0.28% of customers affected; a small number of API keys and third-party secrets exposed	Kernel's own public notice, 4 November 2026

Kernel's notice is a useful example of how these incidents unfold. According to the company, the attacker used a compromised API key from 24 October, accessed a logging provider on 27 October, then on 3 November used a compromised hosting account credential to reach four servers. Kernel believes it was part of a larger cryptomining campaign. Every step relied on a credential that worked when it should not have.

The first hour: lock the doors

1. 01Use a trusted deviceChange credentials from a device you know is clean, not one that may be compromised.
2. 02Change access passwordsHosting panel, FTP and SFTP, SSH, email, database and your domain registrar.
3. 03Revoke and reissue keysAPI keys, deployment tokens and secrets stored with the provider, including AI service keys.
4. 04Turn on two-factor sign-inWherever the provider offers it, starting with the hosting and domain accounts.

Do not forget keys that live inside your application's settings: payment provider keys, email service keys and AI API keys. If they were stored on the breached platform, assume they are exposed and issue new ones.

The first day: look for footprints

• Admin users. Look for any administrator account you do not recognise, in WordPress, your control panel and your database.
• Changed files. Compare your site against a known-good backup or your version control. Attackers often add a small file that gives them a way back in.
• Scheduled tasks. Check cron jobs and scheduled tasks for anything new.
• Redirects and scripts. Visit your site on a phone using mobile data. Some infections only show to visitors, not to logged-in admins.
• Your own software. A breach is a good moment to confirm you are not also running exploitable software. Our free website security check shows whether your PHP version is affected by PHP2Shell.

The first week: decide what needs reporting

If customer personal data may have been exposed, UK GDPR may require you to report the breach to the ICO, and the ICO's guidance says reportable breaches must be notified within 72 hours of becoming aware of them. Write down what you know, when you learned it and what you did, then take advice early rather than late.

Make the next breach a non-event

Breaches at providers will keep happening. What you control is how much damage one can do: separate credentials for each service, keys that can be revoked in minutes, tested backups and a list of where every secret lives. Our maintenance checklist covers these routines, and our guide on where to host a Next.js app compares how different hosting models handle them.

If your provider has just emailed and you would like help working through this list, our managed web application services team can take it from here. Get in touch and tell us who hosts your site.