# SZB-cd29ee2e79: DreamHost says hackers accessed its systems and customer session data for three months

According to a filing with California's Attorney General, DreamHost says hackers had access to its systems, including customer session information, for about three months.

- Type: Breach
- Status: Confirmed
- Vendor: DreamHost
- Disclosed: 2026-11-03 17:09 UTC
- Data taken: Tokens and keys
- Sources: 1 distinct
- First seen by cve.now: 2026-11-03 17:10 UTC · Updated: 2026-11-03 17:15 UTC

Written by a model from the sources below. Verify against them.

## Summary

The item reports that DreamHost had earlier resolved an incident affecting customers' email and FTP access, and that session data could let attackers log in.

## What to do

- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Reset your DreamHost account password
- Log out all active DreamHost sessions and review recent logins
- Enable two-factor authentication on your account
- Check email and FTP access logs for unfamiliar activity

## Timeline

- 2026-11-03 17:09 UTC: Made public by Zack Whittaker on Bluesky
- 2026-11-03 17:09 UTC: Confirmed by DreamHost. Zack Whittaker on Bluesky: “In a filing with California's AG, DreamHost says hackers had access to its systems, including customer session info (which lets attackers log in!), for 3 month…” ([source](https://bsky.app/profile/zackwhittaker.com/post/3mzgdcx6hyc2i))
- 2026-11-03 17:10 UTC: First seen by cve.now

## What was taken

- Tokens and keys: [Zack Whittaker on Bluesky](https://bsky.app/profile/zackwhittaker.com/post/3mzgdcx6hyc2i): “In a filing with California's AG, DreamHost says hackers had access to its systems, including customer session info (which lets attackers log in!), for 3 months!”

## Evidence (1 source)

- 2026-11-03 · Press · [Zack Whittaker on Bluesky](https://bsky.app/profile/zackwhittaker.com/post/3mzgdcx6hyc2i): “In a filing with California's AG, DreamHost says hackers had access to its systems, including customer session info (which lets attackers log in!), for 3 months!”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-cd29ee2e79&body=https%3A%2F%2Fcve.now%2FSZB-cd29ee2e79%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the DreamHost breach

### Was DreamHost breached?

Yes. DreamHost says so: “In a filing with California's AG, DreamHost says hackers had access to its systems, including customer session info (which lets attackers log in!), for 3 months!” (Zack Whittaker on Bluesky).

Source: https://bsky.app/profile/zackwhittaker.com/post/3mzgdcx6hyc2i

### What data was exposed?

Tokens and keys.

### What should DreamHost customers do?

Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Reset your DreamHost account password. Log out all active DreamHost sessions and review recent logins. Enable two-factor authentication on your account. Check email and FTP access logs for unfamiliar activity.

## Related

- Started as early warning SZB-cd29ee2e79, first seen 2026-11-03 17:10 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-cd29ee2e79
Site guide for agents: https://cve.now/llms.txt