Cyber Intruders Compromise DreamHost: Customer Files and Emails Acquired in Extended Breach
DreamHost has announced that a cyberattack lasting several months resulted in the theft of customer emails and login credentials. The company revealed the incident last Thursday, following a multi-day outage during which it was forced to reset numerous customer passwords.
In a notice regarding the data breach submitted to the attorney general of California, DreamHost indicated that the attack commenced in August. The hackers were able to acquire session tokens, which allow users to remain logged in after they have entered their credentials. If such tokens are stolen, the attackers can gain access to accounts as if they were the legitimate users. The breach was attributed to an undisclosed vulnerability within DreamHost’s file manager, a tool utilized by customers to manage their files.
When contacted by TechCrunch, a spokesperson for DreamHost declined to explain why the cyberattack went undetected until last week, referencing an ongoing investigation. They also did not disclose the specific vulnerability involved. The company clarified that this incident was not related to recently identified weaknesses in PHP web software.
According to DreamHost’s spokesperson, the impact on customers was “well under 10%,” but a precise figure was not provided. The web hosting provider claims to serve approximately 400,000 paying customers across its platform.
