Hackers stole DreamHost customer files and inboxes during months-long attack
Quick Look
DreamHost disclosed that hackers stole customer emails and credentials during a months-long cyberattack that began in August, exploiting an unspecified vulnerability in its file manager and obtaining session tokens.
AI-generated summary
Why It Matters
DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days, during which it reset some customer passwords.
Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days, during which it reset some customer passwords.
In a data breach notice filed with California's attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after entering their passwords. If stolen, hackers can break into a system as if they were that user. The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, which customers use to store their files.
When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson did not say what the vulnerability is. The company said it was unrelated to the vulnerabilities recently discovered in the PHP web software.
Open Questions
- How many customers were affected?
- What is the specific vulnerability in the file manager?
- Why did DreamHost not detect the cyberattack until last week?
- Were any customer files accessed or stolen?
