--- title: Hackers stole DreamHost customer files and inboxes... description: DreamHost confirmed hackers stole customer emails and credentials in a months-long breach that began in August. Attackers exploited an unspecified... canonical: https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers stole DreamHost customer files and inboxes during months-long attack | daily.dev og:description: DreamHost confirmed hackers stole customer emails and credentials in a months-long breach that began in August. Attackers exploited an unspecified... og:url: https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k og:image: https://api.daily.dev/og/posts/fgRhAzu5K.png og:image:alt: Hackers stole DreamHost customer files and inboxes during months-long attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers stole DreamHost customer files and inboxes during months-long attack **[TechCrunch](https://daily.dev/sources/tc)** · 1 min read · 0 upvotes · 0 comments ## Summary DreamHost confirmed hackers stole customer emails and credentials in a months-long breach that began in August. Attackers exploited an unspecified vulnerability in DreamHost's file manager to obtain session tokens, which let them impersonate logged-in users. The incident sparked a multi-day outage and forced some password resets before DreamHost disclosed it last Thursday. The company says well under 10% of its customers were affected, and that the flaw was unrelated to the recent PHP vulnerabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did hackers steal DreamHost customer data? Hackers exploited an unspecified vulnerability in DreamHost's file manager, a tool customers use to store files, to obtain session tokens. Session tokens keep users logged in after entering a password, so stealing them let attackers access accounts as if they were the legitimate user. The attack began in August and wasn't disclosed until months later. _Anyone weighing hosting providers after a breach can track security incident coverage on daily.dev._ ### How many DreamHost customers were affected by the 2026 breach? DreamHost said the number of affected customers is well under 10% of its customer base, though it declined to give a more precise figure. DreamHost has roughly 400,000 paying customers across its network. The company also said the breach was unrelated to recently disclosed PHP vulnerabilities. _Developers evaluating hosting providers after an incident can follow breach disclosures like this on daily.dev._ ## Similar posts on daily.dev - [Meta admits to Instagram password reset mess, denies leaks](https://daily.dev/posts/meta-admits-to-instagram-password-reset-mess-denies-leaks-gskm0ords) · The Register · 2 upvotes · 0 comments - [WordPress sites compromised after TeamUpdraft credential exposure](https://daily.dev/posts/wordpress-sites-compromised-after-teamupdraft-credential-exposure-5zodckkmr) · CSO Online · 0 upvotes · 0 comments - [Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites](https://daily.dev/posts/hackers-are-mass-exploiting-a-gravity-smtp-flaw-to-steal-api-keys-from-100-000-wordpress-sites-hhj1prnxn) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers stole DreamHost customer files and inboxes during months-long attack","url":"https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k"},"datePublished":"2026-11-04T20:41:45.757Z","dateModified":"2026-11-04T20:46:05.857Z","description":"DreamHost confirmed hackers stole customer emails and credentials in a months-long breach that began in August. Attackers exploited an unspecified...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/774b941276f480dfcdf848d7bdd4e243?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/774b941276f480dfcdf848d7bdd4e243?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Hackers stole DreamHost customer files and inboxes during months-long attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack-fgrhazu5k#faq","mainEntity":[{"@type":"Question","name":"How did hackers steal DreamHost customer data?","acceptedAnswer":{"@type":"Answer","text":"Hackers exploited an unspecified vulnerability in DreamHost's file manager, a tool customers use to store files, to obtain session tokens. Session tokens keep users logged in after entering a password, so stealing them let attackers access accounts as if they were the legitimate user. The attack began in August and wasn't disclosed until months later. Anyone weighing hosting providers after a breach can track security incident coverage on daily.dev."}},{"@type":"Question","name":"How many DreamHost customers were affected by the 2026 breach?","acceptedAnswer":{"@type":"Answer","text":"DreamHost said the number of affected customers is well under 10% of its customer base, though it declined to give a more precise figure. DreamHost has roughly 400,000 paying customers across its network. The company also said the breach was unrelated to recently disclosed PHP vulnerabilities. Developers evaluating hosting providers after an incident can follow breach disclosures like this on daily.dev."}}]} ```