DreamHost confirms theft of customer emails and credentials in months-long attack

DreamHost confirmed, in a notification sent to the California Attorney General's office, that hackers accessed customers' emails and credentials during an attack that began in August 2026 and was only publicly disclosed on October 29. The company is one of the world's largest providers of shared hosting, VPS, and email, with roughly 400,000 paying customers, and is used by many Brazilian developers and small businesses to host WordPress sites, domains, and corporate email accounts.

The case came to light after an outage hit DreamHost's systems for several days in a row. During the instability, the company reset passwords for some customers without initially detailing the reason. Only later, in the document sent to US authorities, did it become clear that the outage was a direct consequence of a breach that had already been going on for months, according to a report by TechCrunch.

How the hackers got in

According to DreamHost, the attackers exploited an unspecified vulnerability in the platform's file manager, the panel customers use to store and edit their own sites' files. The company made a point of saying the flaw is unrelated to the recently discovered PHP vulnerabilities, ruling out the most obvious hypothesis for those who follow the ecosystem.

Through this flaw, the hackers were able to steal session tokens, the temporary credentials that keep a user authenticated after the initial login. In practice, a stolen session token lets an attacker access the system by impersonating the legitimate user without needing the password or two-factor authentication, because the session is already validated.

Contacted by TechCrunch, DreamHost did not explain why the attack was only detected months after it began, nor what exactly the exploited vulnerability was, citing an ongoing investigation. The company also did not disclose the exact number of affected customers, only a vague estimate:

Well under 10%.

DreamHost spokesperson, in a statement to TechCrunch

Across a base of 400,000 paying customers, that percentage could represent tens of thousands of accounts, even though it's described as a small fraction of the total.

Why this matters for developers in Brazil

DreamHost is not a Brazilian company, but it's a common choice for freelance developers, small agencies, and startups in Brazil that need cheap hosting with its own panel, domain, and professional email all in one place. Anyone who uses the platform's file manager to upload builds, edit wp-config.php directly on the server, or store database backups is exactly the type of customer the flaw may have affected.

The theft of session tokens is also relevant beyond DreamHost's panel. If the same corporate email hosted there is used for password recovery on other services (GitHub, cloud providers, CI/CD tools), an attacker with access to the inbox can chain the attack and compromise accounts outside DreamHost. This is the kind of cascading risk that hosting breaches tend to create and that doesn't always show up in the official statement.

Checklist: what to check now

For anyone with a DreamHost account, especially if you use the file manager, it's worth running a quick check:

1. Change the password for the DreamHost panel and any email hosted there, even if the company has already forced a reset.
2. Review automatic forwarding rules in inboxes: it's a classic persistence trick after a credential leak.
3. Rotate any secrets stored in files accessible through the file manager, such as DATABASE_URL, integration API keys, and SMTP credentials.
4. Check whether files such as .env or database dumps were exposed in file storage during the attack period, from August to October 2026.
5. Enable or review two-factor authentication on accounts that rely on the email hosted at DreamHost for password recovery.
6. Check the access logs available in the panel for unusual IPs or times within the same window.

What remains unclear

DreamHost has left more questions than answers so far. The company hasn't revealed which specific vulnerability was exploited in the file manager, hasn't explained why the attack went undetected for months, and hasn't given a precise number of affected customers, only the estimate that it's "well under 10%" of the base. It also remains unclear whether the stolen emails included message content or just access metadata.

While DreamHost's investigation continues, the practical recommendation for those who depend on the platform is to treat the period from August to October 2026 as an exposure window and act as though any credentials stored there have been seen by third parties, changing everything that hasn't been changed yet.