Source : TechCrunch (AI-generated image)
LOS ANGELES, November 4, 2026 – Web hosting company DreamHost has confirmed that hackers stole customer emails and login credentials during a cyberattack on its systems that went on for months before it was discovered, as reported by TechCrunch.
DreamHost first publicly disclosed the breach last Thursday, October 29, after the attack triggered an outage lasting several days. During that disruption, the company reset the passwords of some of its customers, leaving many website owners and email users without normal access to their services while the company dealt with the attack.
In a data breach notice filed with the attorney general of California, the company said the attack began in August. According to the notice, the intruders were able to obtain session tokens, the small pieces of data that keep users signed in after they have entered their password.
How the attackers got in
Session tokens are valuable to attackers because, once stolen, they can allow someone to access a system as though they were the legitimate user, without needing the password. DreamHost said the hackers took advantage of an unspecified vulnerability in its file manager, the tool customers use to store and manage their files on the service, including website content.
The company has not said what the flaw was. A DreamHost spokesperson told TechCrunch that the vulnerability was not related to the security weaknesses recently found in PHP web software, but declined to give further details.
The spokesperson also declined to explain why the attack was not detected until last week, citing an investigation that is still ongoing, which means key questions about how long the attackers had access to particular accounts remain unanswered.
Scale of the breach
DreamHost said the number of affected customers was “well under 10%” of its user base, but would not give a more precise figure. The web host says it has some 400,000 paying customers across its network, which means the breach could still have touched a significant number of accounts. DreamHost has not said whether every affected customer has been contacted individually or what specific steps it is asking them to take, beyond the password resets carried out during the outage.
The incident is a reminder of the risks faced by hosting providers, which store websites, files and email for large numbers of individuals and businesses. A single weakness in a shared tool, such as a file manager, can expose data belonging to many customers at once, and an attack that goes unnoticed for months gives intruders more time to collect information.
For DreamHost customers, the confirmation that inboxes, files and credentials were taken makes it important to follow the company’s guidance. General good practice after a breach of this kind includes changing passwords, especially where the same password has been used on other services, signing out of active sessions, and watching for suspicious emails that may try to take advantage of stolen information.
DreamHost has not yet said when its investigation is expected to conclude or whether it will publish more details about the vulnerability once the work is complete.
About The Author
