DreamHost Confirms Customer Emails and Credentials Were Stolen in a Months-Long Attack

DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems, according to TechCrunch.

The hosting provider disclosed the breach last Thursday, after an outage that lasted several days. During that outage, DreamHost reset passwords for some customers. The company has not tied the reset directly to the intrusion, so the two events are best read as separate occurrences that the company has since placed on the same timeline.

In a data breach notice filed with California's attorney general, DreamHost said the attack began in August. That puts the intrusion's dwell time, the period an attacker stays inside a system before discovery, at roughly two months before the public disclosure.

On the mechanics, DreamHost said the attackers obtained session tokens, the values that keep a user logged in after a password has been entered. The company also said the intruders exploited an unspecified vulnerability in the file manager customers use to store files. DreamHost said the attack was unrelated to recently discovered vulnerabilities in PHP, the web scripting language, a distinction that matters to operators who had been patching PHP stacks in the same period.

Scope is the least settled part of the disclosure. A DreamHost spokesperson said the number of affected customers is "well under 10%" but declined to give a more precise figure. The company says it has some 400,000 paying customers across its network, so the percentage is the only measure of impact it has offered, and it is not tied to a count.

The broader context here is what was taken. Email accounts rarely stay contained to one service, because a mailbox often serves as the recovery channel for other accounts. Credentials exposed at a host can therefore become inputs to attacks elsewhere. Session tokens add a separate problem. A password reset replaces the secret a user types, but it does not by itself invalidate a session token an attacker already holds, unless the platform also revokes active sessions. Whether DreamHost has done that, and how long the stolen tokens stayed usable, are questions the disclosure does not answer.

In my view, the more instructive detail is the order of events. A multi-day outage, a password reset affecting some customers, and a breach notice with an August start date point to an incident whose boundaries were established only gradually. For customers, the practical steps are concrete: rotate credentials stored or used through DreamHost accounts, reauthenticate sessions, and treat mailboxes as potentially exposed. For the wider hosting market, the file manager is the component to watch. Shared hosting platforms concentrate many customers' files, mail and control panels behind one authentication surface, which makes a single flaw in one layer unusually valuable to an attacker.

What would most sharpen the picture is a fuller description of the file manager vulnerability and a more precise count of affected accounts. Session revocation, scoped credential resets and mailbox monitoring are well-understood tools, and their effectiveness depends on how completely a provider applies them. A breach's full footprint often becomes visible only after the first notice, and customers are usually the ones who need the detail soonest.