DreamHost Breach Exposed Customer Files and Inboxes in a Months-Long Attack

The DreamHost data breach, explained

Web host DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack, according to a data breach notice filed with California's attorney general and reported November 4, 2026. The DreamHost data breach began in August and exploited an unspecified vulnerability in DreamHost's file manager, the tool customers use to store their files. Attackers obtained session tokens, which keep users logged in after they enter their passwords, and the company says the number of affected customers is well under 10 percent, without giving a precise figure.

The timeline is the uncomfortable part. An attack that runs for months before disclosure means stolen session tokens and credentials had a long window of usefulness. DreamHost disclosed the breach last week after it sparked a multi-day outage, during which it reset some customer passwords. That sequence, outage first, full explanation later, is common in breach disclosures, but it leaves customers guessing about what was taken and when, exactly when they most need clear instructions.

What was taken, as described so far, includes customer emails and credentials plus files accessible through the file manager. Session tokens deserve special attention: unlike a password, a session token lets an attacker act as you without logging in at all, until it expires or is revoked. That is why DreamHost's password resets, while necessary, are only half the response. Revoking active sessions matters just as much, and customers should check whether their hosting accounts offer a "sign out everywhere" option and use it.

What the DreamHost data breach exposed

The filing leaves several questions unanswered, and those gaps are worth naming. DreamHost has not specified which vulnerability in the file manager was exploited, has not given an exact count of affected customers, and has not detailed which file contents were accessed. "Well under 10 percent" is a reassuring phrase that tells an individual customer almost nothing about their own risk. If you host with DreamHost, assume your account was in scope until you hear otherwise, and act accordingly.

The practical steps are straightforward. Change your DreamHost password to a long, unique one, and turn on two-factor authentication if you have not already. Change the password on any other service where you reused the same credentials, because credential reuse is how a hosting breach becomes an email breach, a banking problem, or a domain hijacking. Check your hosted files and email for unfamiliar changes, forwarding rules, or new admin users. If you run a website on DreamHost, check for injected code or unfamiliar files, and restore from a clean backup if anything looks wrong.

There is a broader lesson here for anyone choosing a web host. File managers are convenient, and they are also a large attack surface: a single flaw can expose many customers at once. Hosts that offer SSH and SFTP access, detailed access logs, and prompt patching give you more control and more visibility than a web-only file manager. None of that guarantees safety, but it changes a breach from "we will tell you eventually" into something you can investigate yourself.

Why hosting breaches hit harder than they look

A hosting account is not just a website. It often holds your domain settings, your email, your databases, and your backups, which means a compromise can cascade into every service connected to that domain. Attackers who control a hosting account can redirect a site, intercept password-reset emails, or use a trusted domain to send phishing messages that pass casual inspection. That is why this breach matters beyond DreamHost's customer count: it is a reminder that your hosting account is one of the most powerful accounts you own, and it deserves the same protection as your email and bank accounts.

DreamHost customers should also watch for phishing emails that reference the breach. Attackers routinely follow a public disclosure with fake "security alert" messages that link to credential-harvesting pages. DreamHost will not ask you to confirm your password by email, and any message that does is itself an attack. Our guide on what to do after a data breach walks through the full checklist calmly, and our link safety guide covers how to check a suspicious message in 30 seconds. If you are a DreamHost customer and you have not yet changed your password and enabled two-factor authentication, do that today, before you do anything else with the account.