DreamHost Breach Exposes Customer Files, Emails and Login Tokens
DreamHost says hackers stole customer emails, files, credentials and session tokens in an attack that began in August and disrupted service for several days.
Summary
DreamHost confirmed on November 4, 2026, that hackers stole customer files, email inboxes, credentials and session tokens during an intrusion that began in August. The company disclosed the breach the previous Thursday after it caused a multiday outage and prompted resets of some customer passwords. Its notice to California’s attorney general says attackers exploited an unspecified vulnerability in DreamHost’s customer file manager.
Stolen session tokens can give attackers access as authenticated users without requiring their passwords again. DreamHost says well under 10% of its roughly 400,000 paying customers were affected but has not provided a precise figure. Citing an ongoing investigation, a spokesperson declined to explain why the attack was not detected until the previous week or identify the vulnerability, but said it was unrelated to recently discovered flaws in PHP web software.
Positives
- DreamHost reset some customer passwords after the breach caused a multiday outage.
- Well under 10% of DreamHost’s roughly 400,000 paying customers were affected, according to the company.
- DreamHost says the exploited flaw was unrelated to recently discovered vulnerabilities in PHP web software.
- DreamHost filed a breach notice with California’s attorney general after disclosing the incident.
Risks & concerns
- The intrusion began in August and remained undetected until the week before November 4, 2026.
- Hackers stole customer files, email inboxes, credentials and session tokens from DreamHost systems.
- Stolen session tokens can let attackers enter accounts as authenticated users without re-entering passwords.
- The breach triggered an outage lasting several days and forced some customer password resets.
- DreamHost has not identified the exploited file manager vulnerability or provided a precise victim count.
- DreamHost declined to explain the months-long detection delay, citing an ongoing investigation.