DreamHost told California’s attorney general that its breach date was August 15, 2026, more than two months before the web host noticed anything wrong. Zack Whittaker of TechCrunch reported on November 4 that the company has now confirmed what the intruders took: customer emails, credentials and session tokens, in what DreamHost itself described as a deliberate attack.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
A spokesperson put the share of customers affected at “well under 10%” of roughly 400,000 paying accounts and would not give a tighter number.
From August to the October 23 shutdown
The attack began in August, per the breach notice DreamHost filed with California, whose attorney general listing gives August 15 as the date of the breach, marked as known. DreamHost’s October security incident announcement, dated October 29, says people who logged into its File Manager from roughly August onward may have had FTP and SFTP credentials exposed, and that it found the intrusion on the afternoon of Friday, October 23, and took the File Manager servers offline.
Outages followed over several days: SecurityWeek and Rescana’s reconstruction of DreamHost’s status page puts File Manager offline from about 5:20 p.m. Pacific on October 23, with a fix pushed on October 26 at 3:35 p.m. and the incident then moved to monitoring. its October 27 report said the root cause and the number of affected users were still unconfirmed, and that its request for details went unanswered. BleepingComputer’s October 26 coverage described DreamHost blocking access until users completed password resets, which the company called a precaution, and noted that the cause and the number of affected accounts were still undisclosed. A spokesperson declined to say why the attack went unnoticed for so long, citing the ongoing investigation.
Customers were left guessing during that stretch. Long-time users complained about the lack of information, and one called it disturbing to get such emails with zero explanation of what was going on. DreamHost said it could not contact individual mailbox or FTP users directly, so account owners had to pass the reset news to the people using their email addresses by phone, text or another route.
What session tokens let an attacker do
TechCrunch explains that session tokens keep a user logged in after the password has been entered, so with a stolen token an intruder can reach a system as that user without ever knowing the password. That is why DreamHost’s response went past password resets: webmail credentials were reset and active sessions ended on October 23, and the company says it rotated potentially exposed internal credentials.
DreamHost’s announcement says the attacker exploited a flaw in third-party software behind the File Manager. The company told TechCrunch the vulnerability is unrelated to the PHP web software bugs that TechCrunch covered on October 24, a point the announcement repeats, stating that its PHP servers were patched within hours of release.
Mailboxes, scope and what the company says it checked
Beyond file-transfer logins, the announcement says the attacker also reached some webmail systems and obtained login credentials for a limited number of webmail users. In a small number of cases DreamHost believes mailbox contents may have been viewed, and it is contacting those customers individually. It reports no evidence that control panel logins or billing details were accessed, and says full card numbers are not stored because a third-party processor handles payments.
Credential resets reached beyond file transfer. DreamHost told account holders to check each email address for forwarding rules and to remove any destination they did not recognize, a step BleepingComputer read as a sign that some mailboxes may have been breached. Customers who reused the old DreamHost password elsewhere were told to change it on those other services too.
The company’s figures are its own. It says well under 10 percent of email and FTP/SFTP accounts were affected and that fewer customers are now believed to be involved than first suspected, but the TechCrunch report shows no independent count, and the California page does not state how many people were affected.
Customers are advised to use unique passwords, update saved email and FTP clients, check website files for unfamiliar changes and review webmail forwarding rules and filters. Account owners must reset passwords through the control panel by typing its address directly into a browser, a new FTP or SFTP password can take up to 15 minutes to take effect, and DreamHost says it will never email asking for a password.
Websites, email delivery and stored files stayed available throughout, according to the company, and customers who run deployment scripts, backup tools or plugins over FTP or SFTP have to update the saved credentials there as well, or those jobs will fail. What remains open is the length of the gap: DreamHost has not said how an intruder stayed inside from mid-August to late October, why monitoring did not catch it sooner, or how many customers lost session tokens as opposed to passwords. The California filing, which lists the August 15 date, is the only formal record so far, and the sample notice letter attached to it is where any further wording on data categories would appear.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
