DreamHost (United States) notified the California Attorney General, the Vermont Attorney General and the Washington Attorney General of a data breach on 2 November 2026. It told the states about 871 Washington residents; the total can be higher.
People affected
871Washington residents · one state’s count, the total can be higher
Reported
2 November 2026Official notice and 3 more
Time to tell
79 daysfrom 15 August 2026 · the median is 147
Across the state notices
at least 928 people (Vermont and Washington: each state counts only its own residents)
Found to notice
10 days (found 23 October 2026, by the company’s letter)
What was exposed 4
Passwords and logins
Email addresses
Customer files
Inboxes
How it happened
How
Software flaw hackers exploited a vulnerabilitysource
Official notices are read by code from the regulator’s own register. News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. More notices to California, Vermont, Washington. · Corrections and changes
Questions about the DreamHost breach
Was DreamHost hacked?
DreamHost (United States) notified the California Attorney General, the Vermont Attorney General and the Washington Attorney General of a data breach on 2 November 2026. It told the states about 871 Washington residents; the total can be higher. How it happened, by the sources: software flaw.
What data was exposed in the DreamHost breach?
Passwords and logins, Email addresses, Customer files and Inboxes, by the notices and reports on this page.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. The letter it filed is on this page. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a DreamHost data breach settlement?
No settlement open for claims is on record for DreamHost as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the DreamHost breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to DreamHost’s own site, or check the letter here.
Privacy Unpacked