DreamHost Confirms Months-Long Breach Exposing Customer Files and Inboxes

DreamHost, a major web hosting provider, has officially confirmed that its systems were compromised during a months-long cyberattack, resulting in the theft of customer emails, credentials, and internal files. The breach was disclosed last Thursday following a multi-day service outage, during which the company proactively reset passwords for affected users to mitigate further unauthorized access. This incident marks a significant security setback for the company, which prides itself on reliability for over 400,000 paying customers. According to a data breach notice filed with the California Attorney General, the intrusion began in August. Cybercriminals exploited an unspecified vulnerability in DreamHost’s file manager, the tool customers use to store and manage their digital assets. The attackers successfully stole session tokens, which are cryptographic keys that keep users logged in. Possession of these tokens allows hackers to bypass password authentication and access systems as if they were the legitimate users, granting them deep visibility into client inboxes and stored documents. When contacted by TechCrunch, a DreamHost spokesperson declined to explain why the attack went undetected until last week, citing an ongoing internal investigation. The company also withheld details on the specific nature of the vulnerability but clarified that it is unrelated to recent, widely publicized flaws discovered in PHP web software. This lack of transparency has raised questions about the company’s monitoring capabilities and incident response protocols. The scope of the breach appears limited relative to the company’s total user base. The spokesperson stated that the number of affected customers is "well under 10%" of the total, though a precise figure was not provided. Given DreamHost’s network size, even a small percentage represents a substantial number of individuals and businesses whose data may have been exposed. The company is currently working to secure its infrastructure and notify all potentially impacted parties in accordance with legal requirements. This incident underscores the persistent threat posed by sophisticated cyberattacks targeting infrastructure providers. As web hosts manage vast amounts of sensitive data, they remain high-value targets for malicious actors. The breach highlights the critical need for robust security measures, continuous monitoring, and transparent communication in the event of a data compromise. Users are advised to change their passwords and enable multi-factor authentication to protect their accounts.