DreamHost says an attack that began in August exposed customers’ email messages and account login details, according to TechCrunch, which reported the breach on November 4, 2026. The article says DreamHost did not detect the attack until the week before publication.

What was taken

  • Customers’ email messages and account login details.
  • Session tokens, which keep a user signed in after a password is entered. An attacker holding a stolen token could access an account as that user.

Scale and method

  • A DreamHost spokesperson said the share of affected customers is “well under 10%” but would not give a more precise figure. TechCrunch cites DreamHost’s claim of about 400,000 paying customers.
  • Hackers exploited an unspecified vulnerability in DreamHost’s file manager, which customers use for file storage. The spokesperson did not identify the vulnerability and said it is unrelated to the recently disclosed PHP web software vulnerabilities.
  • The spokesperson declined to explain the delay in detection, citing an ongoing investigation, per the article.

How it was disclosed

DreamHost described an October security incident in an announcement published after a multi-day outage, during which it reset some customer passwords, and it filed a data breach notice with the California Attorney General, according to TechCrunch. The article’s headline says files were taken as well, but its body text does not explicitly confirm file theft.

Sources and notes

This post is based on TechCrunch’s In Brief report by Zack Whittaker (12:36 p.m. PST, November 4, 2026). Lens did not read DreamHost’s announcement, its status page or the California Attorney General notice, and the customer count is DreamHost’s own claim as cited by TechCrunch.

Image: three external hard drives stacked on a wooden table, by Shixart1985 via Wikimedia Commons, licensed under CC BY 2.0; cropped. Stand-in photo; it is not related to DreamHost and does not show the events described.