Los Angeles — DreamHost Confirms Hackers Stole Customer Files, Emails

Web hosting company DreamHost has confirmed that hackers stole customer emails, files and login credentials during a cyberattack that went undetected for months, according to a data breach notice filed with California's attorney general and reported by TechCrunch.

The breach affects paying customers who store email and files through DreamHost's hosting platform. The company said in its filing that the number of affected customers is "well under 10%" of its base, though a spokesperson declined to give TechCrunch a more precise figure. DreamHost has told the public it serves roughly 400,000 paying customers across its network, according to the company's own figures cited by TechCrunch.

What did the hackers actually take?

According to the breach notice, hackers obtained session tokens — the digital keys that keep a user logged into a website after a password has already been entered. If a session token is stolen, an attacker can access an account as if they were the real customer, without needing the password again. DreamHost said the intrusion gave hackers access to customer emails and files stored on its systems.

The company said the attackers got in by exploiting an unspecified vulnerability in DreamHost's file manager, the tool customers use to upload and organize files on their hosting accounts. A DreamHost spokesperson would not tell TechCrunch what the specific vulnerability was, citing an ongoing investigation. The spokesperson did confirm one thing clearly: the flaw was not related to the PHP web software vulnerabilities that have circulated recently in the security community, a distinction DreamHost wanted on the record given how widely those PHP issues have been discussed.

When did this start, and when did customers find out?

The timeline laid out in DreamHost's own filing runs several months. The intrusion began in August 2026, DreamHost said. The company did not say when it first detected suspicious activity. What's known is that the breach became public only after it caused a visible problem: an outage that lasted several days and forced DreamHost to reset passwords for some customers. DreamHost formally disclosed the breach the following week, on what TechCrunch described as "last Thursday" relative to its November 4 report.

"Well under 10%" of DreamHost's customers were affected, a company spokesperson told TechCrunch, without providing a more specific number.

When TechCrunch asked why DreamHost did not detect the attack until the outage forced the issue, the spokesperson again cited the ongoing investigation and declined to answer.

Why does a stolen session token matter more than a stolen password?

For customers who are not security professionals, the distinction matters. A stolen password can be fixed by resetting it. A stolen session token can let an attacker skip that step entirely and act inside an account that is already logged in — reading stored emails, downloading files, or making changes — until the token is invalidated. That is why DreamHost reset passwords for some customers as part of its response to the outage, according to the company's disclosure.

What should DreamHost customers do now?

DreamHost's filing does not list a formal remediation checklist for customers, but the facts in the disclosure point to the obvious first steps: customers should change their DreamHost password, log out of all active sessions if the platform offers that option, and review any email or files stored on the account for signs of unauthorized access. Anyone who reused their DreamHost password on other sites should change it there too, since a password reused elsewhere could expose other accounts if it was compromised.

Customers who want to see exactly what DreamHost told regulators can review the breach notice filed with the California Attorney General's office, the same filing TechCrunch drew its reporting from.

Is this breach connected to other recent hosting attacks?

DreamHost explicitly ruled out one connection: the spokesperson told TechCrunch the vulnerability exploited in this attack was not related to recently disclosed flaws in PHP, the web programming language used broadly across hosting platforms. Beyond that denial, DreamHost has not said whether the attack resembles other recent breaches at hosting providers, and the company's investigation into the vulnerability itself remains open, according to the spokesperson's comments to TechCrunch.

DreamHost has not said whether it plans to offer credit monitoring or other remediation to affected customers, and the company did not respond to those specifics in its statement to TechCrunch. The investigation into how long hackers had access and what else may have been exposed continues.

mindfulAI Keyboard — An iPhone keyboard that rewrites a draft in a tone you pick. Four free AI actions a day.