Hackers stole DreamHost customer files and inboxes during months-long attack
Web hosting company DreamHost has confirmed that a cyberattack beginning in August led to the theft of customer emails and credentials. The breach was only detected last week, after an outage lasting several days.
DreamHost, a web hosting provider, has confirmed that hackers broke into its systems over a period of months and stole customer emails and login credentials. The company disclosed the incident last Thursday, after it caused an outage lasting several days. During that time, DreamHost reset passwords for some customers.
In a data breach notice filed with the California attorney general, the company said the attack started in August. The intruders obtained session tokens, which keep users logged in after they enter their passwords. If such tokens are stolen, attackers can access a system as though they were the legitimate user.
Flaw in the file manager
DreamHost said the hackers exploited an unspecified vulnerability in its file manager, the tool customers use to store their files. The company has not said what the flaw is. It added that the issue is unrelated to the vulnerabilities recently discovered in PHP web software.
Investigation continues
When TechCrunch asked why the attack went undetected until last week, a company spokesperson declined to answer, citing the ongoing investigation. The spokesperson also did not identify the vulnerability.
According to the spokesperson, the share of affected customers is “well under 10%”, though no more precise figure was given. DreamHost says it has about 400,000 paying customers across its network.
