DreamHost breach exposed customer files, emails and session tokens
DreamHost has confirmed that a cyberattack lasting months resulted in the theft of customer emails, credentials, files and inbox contents. The web host said the intrusion began in August and involved an unspecified vulnerability in its file manager, a service customers use to store files.
The company disclosed the incident last Thursday after a multi-day outage. During that disruption, DreamHost reset passwords for some customers. In a data-breach notice filed with the California attorney general, it said attackers also obtained session tokens.
Stolen tokens can bypass a password prompt
Session tokens keep a user signed in after authentication. If an attacker obtains a valid token, they can access a system as that user without entering the account password again. That makes the exposure significant even where a password has not itself been reused or directly compromised.
DreamHost did not identify the flaw used in the attack. A company spokesperson said the investigation remains ongoing and declined to explain why the activity was not detected until the previous week. The company also said the incident was unrelated to vulnerabilities recently identified in PHP web software.
Scope remains imprecise
DreamHost said the number of affected customers was “well under 10%,” without giving a more exact figure. The provider says it has about 400,000 paying customers across its network, so the statement establishes an upper bound but not a confirmed count of affected accounts.
The reported data types matter because hosting accounts often combine website files, email services and account administration. Access to those materials can expose operational information, credentials stored in files, or correspondence that could be useful in later account-compromise attempts.
Actions for hosting customers
Customers whose accounts may have been affected should review active sessions, change account passwords and replace credentials that may have been stored in hosted files. They should also examine mailbox activity and file access for unexpected changes, especially for accounts used to administer websites or business email.
For businesses, the practical implication is to treat hosting control panels, file managers and webmail as closely linked access points: session invalidation, credential rotation and targeted log review should be coordinated rather than handled as separate tasks.