Web hosting company DreamHost has disclosed that hackers stole customer emails and login credentials in an attack that began in August 2026 and went undetected for months. The company confirmed the breach in a notice filed with the California Attorney General after an outage last week forced it to reset some customer passwords.
What happened
According to DreamHost’s own incident announcement, attackers exploited a vulnerability in the company’s file manager tool, the feature customers use to store and manage files on their hosting accounts. Once inside, they obtained session tokens, the digital keys that keep a user logged in after entering a password, which let them access customer inboxes and files without needing the password itself.
DreamHost disclosed the breach after a multi-day outage last week, during which it reset passwords for some customer accounts. The company’s data breach notice filed with California’s Attorney General describes the attack and confirms the file manager vulnerability as the entry point.
DreamHost is one of the larger independent web hosts still operating outside the major cloud platforms, hosting both small business sites and WordPress installations for individual customers. A breach touching inboxes and stored files, rather than just account metadata, is a more serious category of incident than a typical password leak, since it can expose the actual content customers store on their hosting accounts.
How many customers are affected
A DreamHost spokesperson told TechCrunch that the share of affected customers was “well under 10%” of DreamHost’s roughly 400,000 paying customers, without giving an exact figure. DreamHost said the vulnerability is unrelated to a separate set of PHP web software bugs discovered recently.
The spokesperson declined to explain why the attack went undetected from August until last week’s outage, citing an ongoing investigation, and did not identify the specific flaw in the file manager tool.
How the attack worked
A session token is the credential a browser holds after a user logs in, so the site does not ask for a password on every click. Normally only the legitimate user’s device has this token. By exploiting the file manager flaw, the attackers were able to extract these tokens directly, which let them step into active customer sessions without ever needing to know a password.
That access path explains why the intrusion stretched from August to late October without detection. A stolen password alone can be more visible when it is used, because unusual login locations or failed attempts can trigger alerts. A hijacked session token looks, to most monitoring systems, like the genuine account owner continuing to browse normally.
What this means for DreamHost customers
Because the attackers obtained session tokens rather than just passwords, a password change alone may not fully lock out unauthorized access if a stolen session was still active at the time of the reset. Security practice generally calls for affected users to also log out of all active sessions everywhere, rotate any API keys or credentials that were stored in the file manager, and review hosted email accounts for unfamiliar sent messages, forwarding rules, or login activity.
DreamHost has not published a full public list of affected accounts. Customers who received a direct breach notification from the company have official confirmation that their account was among those affected; DreamHost’s spokesperson did not say whether notifications had reached every impacted customer by the time of its disclosure.
The company said the file manager vulnerability exploited here is unrelated to a separate set of PHP web software bugs that security researchers flagged across the hosting industry in recent months, a distinction DreamHost drew specifically to avoid the breach being conflated with that wider issue.
Why the breach took months to surface
DreamHost’s spokesperson declined to explain why the intrusion went undetected between August and the outage last week, citing an ongoing investigation, and did not identify the specific flaw in the file manager tool. The company has not said whether the vulnerability has since been patched, though the multi-day outage and mass password resets point to active remediation work at the time of disclosure.
Frequently asked questions
Is my DreamHost account affected?
DreamHost says well under 10% of its roughly 400,000 paying customers were affected, and that it is notifying impacted accounts directly rather than publishing a full list.
Is changing my password enough?
Not on its own. Because the attackers used stolen session tokens, DreamHost customers are advised to also log out of all active sessions and rotate any credentials or API keys stored in the file manager tool.
Is this related to the recent PHP software bugs affecting other hosts?
No. DreamHost has specifically said this vulnerability is unrelated to those separately discovered PHP issues.
Leave a Reply