DreamHost discloses breach after attackers access customer files and webmail accounts

Web hosting provider DreamHost has revealed that hackers breached its systems and stole customer credentials, session information, and webmail data. In a disclosure to affected organizations and a notice filed with California's attorney general, the company explained that the intrusion began in August 2026 and remained undetected until roughly two weeks ago, triggering an outage that spanned several days. [1][2]

Attackers exploited an unspecified flaw in DreamHost's web-based File Manager at files.DreamHost.com to harvest FTP and SFTP credentials as well as session tokens that bypass password prompts. While DreamHost has about 400,000 paying customers, a company spokesperson told TechCrunch that the breach affected "well under 10%" of its customer base. The host emphasized that it found no evidence of compromised control panel credentials or billing details, noting that full payment card numbers are not stored on its network. [1][2]

DreamHost terminated active sessions for impacted users, patched the vulnerability, and reset affected account passwords. The company is offering affected individuals one year of free credit monitoring and identity theft protection through Equifax while working with outside forensic and legal advisors. Nobody has claimed responsibility for the cyberattack, and stolen data has not surfaced on the dark web. [1]