DreamHost Breach Exposes Customer Credentials and Private Emails

The intrusion began in August, remaining undetected until a service outage triggered a company-wide investigation last week. According to a filing with the California attorney general, attackers exploited an unspecified vulnerability within the DreamHost file manager tool. This flaw allowed the bad actors to intercept session tokens, effectively granting them persistent access to customer accounts without needing to re-authenticate.

While the company claims the breach is unrelated to recent high-profile PHP vulnerabilities, leadership remains tight-lipped regarding how the intrusion persisted for months without discovery. A spokesperson confirmed that fewer than 10% of their 400,000 paying customers were affected, though they declined to provide a precise headcount or technical details about the exploited vulnerability, citing the ongoing investigation.