DreamHost confirms months-long breach that stole customer emails and session tokens

What happened

Web host DreamHost has confirmed that hackers spent months inside its systems and made off with customer emails, files and login credentials. According to TechCrunch, the company disclosed the incident after the attack set off an outage that stretched across several days, during which DreamHost reset some customer passwords.

The attack and what was taken

In a data breach notice filed with California's attorney general, DreamHost said the intrusion began in August and that the attackers obtained session tokens, the mechanism that keeps a user logged in after they have entered their password. A stolen session token is valuable precisely because it sidesteps authentication: whoever holds one can reach the account as if they were its owner, no password required.

TechCrunch reports that customer inboxes and files were among the data accessed during the attack, alongside the credentials and session tokens named in the notice.

How the attackers got in

DreamHost attributed the initial access to a vulnerability in its file manager, the tool customers use to store and manage files on their hosting accounts. The company did not specify what the flaw was, and a spokesperson declined to describe it when TechCrunch asked.

The spokesperson did rule out one theory, telling TechCrunch the bug was unrelated to the vulnerabilities recently discovered in the PHP web software.

Questions left unanswered

DreamHost has not explained why an intrusion that began in August went undetected for months. A spokesperson declined to answer when TechCrunch asked, citing an ongoing investigation.

The scale of the breach is also fuzzy. DreamHost put the number of affected customers at "well under 10%" but would not give a more precise figure. The company says it has roughly 400,000 paying customers, so even that ceiling could translate to a large number of compromised accounts, though the true figure may be far smaller.

Why it matters

The theft of session tokens changes what affected customers need to do. Because a token keeps a session alive independently of the password, changing a password does not by itself evict an intruder who holds one. DreamHost reset some customer passwords during the outage, but standard practice after token theft also includes revoking active sessions and enabling two-factor authentication where it is available.

The incident is also a reminder of how much trust hosting customers place in their provider. The compromised file manager and the mail stored on DreamHost's servers are infrastructure customers cannot patch or monitor themselves, and the months-long detection gap gave the attackers a long window in which to move through that data.

Finally, the vagueness of the disclosure makes the incident hard to assess. Describing the affected population only as "well under 10%" of customers, without an exact count, gives customers little way to judge their own exposure. Until DreamHost identifies the file manager flaw and explains why the intrusion went unnoticed for so long, the breach will remain difficult for outsiders to evaluate.