Web host DreamHost has confirmed that hackers stole customer emails and login credentials during a cyberattack that ran for months before it was spotted. The company disclosed the breach last week after an outage lasting several days, during which it reset some customer passwords.

In a notice filed with California's attorney general, DreamHost said the attack began in August 2026 and let intruders obtain session tokens, which keep users signed in after they enter a password. Stolen tokens can let an attacker enter a system as if they were the legitimate user.

File Manager flaw behind the intrusion

DreamHost's own incident post says an unauthorised third party exploited a vulnerability in the third-party software behind its browser-based File Manager, at files.dreamhost.com. The company discovered the activity on Friday 23 October 2026, took the File Manager servers offline and fixed the flaw.

Attackers were able to reach the FTP and SFTP usernames and passwords of users who signed into File Manager before the activity was detected. They also reached some webmail systems and obtained the login credentials of a limited number of webmail users. DreamHost says that in a small number of cases, mailbox contents may have been viewed, and those customers are being contacted individually.

Who is affected and what to do

DreamHost says the incident affected well under 10% of its customers. The company, which describes itself as having some 400,000 paying customers, has not given a more precise figure. It says there is no evidence that control-panel logins or billing details were accessed, and that it does not store full payment card numbers.

Affected users must reset passwords through the DreamHost control panel, update any saved passwords in email or FTP clients, and check webmail forwarding rules and website files for changes they did not make. DreamHost warns that it will never email users asking for their password.

Sources: TechCrunch, Hackers stole DreamHost customer files and inboxes during months-long attack, 4 November 2026; DreamHost, October Security Incident, 29 October 2026.