DreamHost says breach exposed emails and session tokens

The web host said hackers exploited its file manager in an attack that began in August and caused outages, password resets, and unanswered questions.

DreamHost has confirmed that hackers stole customer emails, credentials, and session tokens in a cyberattack that lasted for months before the company discovered it. The web hosting provider disclosed the breach after it caused a multi-day outage and forced some customers to reset their passwords. The incident stands out not just because DreamHost is a major web host, but because the attack appears to have gone undetected for an extended period. For customers, the practical risk is clear: stolen session tokens can let an intruder stay inside an account even without a password.

Attack began in August and hit DreamHost’s file manager

According to a data breach notice filed with California’s attorney general, the attack began in August. DreamHost said the hackers exploited an unspecified vulnerability in its file manager, the tool customers use to store files on the service.

The company did not identify the flaw and said it was not related to recently discovered vulnerabilities in PHP web software. As IT-PUB News notes, that rules out one widely discussed software issue, but it still leaves unanswered what was actually exploited inside DreamHost’s own systems.

DreamHost also said the breach affected customer emails and credentials. Those are among the most sensitive pieces of account data, since they can be used to access inboxes and, if passwords are reused, potentially other connected services as well.

Session tokens could let attackers act as logged-in users

One of the more serious details in DreamHost’s disclosure is the mention of session tokens. These are the digital keys that often keep a user signed in without requiring a password every time.

If attackers steal those tokens, they may not need the password at all. DreamHost said the stolen tokens could be used to break into a system as if the attacker were the legitimate user.

That makes the incident more than a standard password leak. It suggests hackers may have had a way to move through the system while appearing to be trusted users.

DreamHost has not explained the delay in detection

When TechCrunch asked why the company did not detect the cyberattack until last week, a DreamHost spokesperson declined to answer, citing an ongoing investigation. The spokesperson also would not identify the vulnerability that was used.

DreamHost has not provided a more precise timeline for when it first noticed the breach internally, beyond saying the attack started in August and was disclosed last Thursday. That gap is likely to draw scrutiny, especially because the incident caused service disruption before the company publicly confirmed what had happened.

The company said the outage lasted several days and led it to reset some customer passwords. Even when done as a security measure, that kind of response can be disruptive for users.

DreamHost says fewer than 10% were affected

DreamHost’s spokesperson said the number of affected customers is “well under 10%,” but did not give a more exact figure. The company says it has around 400,000 paying customers across its network, so even a small percentage could still amount to a large number of accounts.

Without a specific count, the full scope of the breach remains unclear. That makes it harder for customers to judge their own risk, especially when the stolen data includes both credentials and session tokens.

For a web host, trust depends heavily on the security of the systems behind customers’ sites and inboxes. When a provider like DreamHost is compromised, the damage can extend beyond individual accounts and shake confidence in the service itself.

Why the breach matters for users and businesses

The incident matters because web hosting companies sit close to the infrastructure that businesses and individuals rely on every day. A breach at that level can expose not just personal emails, but also access to websites, stored files, and other online services tied to the same account.

DreamHost has not said how many customers had files, inboxes, or credentials exposed, and it has not explained exactly how long hackers had access before the breach was contained. Still, the company’s disclosure shows this went beyond a routine login issue and reached systems that manage customer data.

For users, the immediate concern is whether their accounts were among those affected and whether their passwords or sessions were reset. More broadly, the case shows how a service provider can become a single point of failure when attackers find a weakness in a shared platform. It also underlines a stubborn security problem: even after passwords are changed, stolen session tokens can still provide a path back into an account.