Hackers stole DreamHost customer files and inboxes during months-long attack

DreamHost has confirmed what its customers only suspected: someone was inside the building for months. The web host says hackers exploited a vulnerability to reach customer files and inboxes, and it has settled on the phrase "deliberate attack" to describe it. That phrase is doing quiet work. It separates a targeted intrusion from the ambient noise of automated scanning, and it prepares the ground for the questions that follow.

The mechanics matter more than the label. A hosting provider is not a single company; it is a landlord holding the keys to thousands of tenants' mailboxes, databases, and backups. One unpatched flaw in shared infrastructure is not one breach. It is a master key, and the duration of the access is the real headline. Months means the attackers had time to be selective, to read before they took, and to leave without tripping alarms.

Watch where the disclosure stops. DreamHost has named the vector and the victim class but not the number of accounts, the data categories, or the timeline of discovery. Those omissions are standard, and they are also the only details that let customers judge their own exposure. Until they arrive, every affected business is running its own risk assessment on incomplete information.

The practical lesson is unglamorous. Email archives are the softest asset most small organizations own, and they sit with a third party precisely because nobody wanted to manage them. Concentration buys convenience and sells resilience. The bill for that trade arrives later, usually in a press statement written months after the fact.