Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days, during which it reset some customer passwords.
In a data breach notice filed with California's attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after entering their passwords. The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, which customers use to store their files.
DreamHost said an unauthorized third party exploited a vulnerability in third-party software behind its web File Manager at files.dreamhost.com. The company found the problem on the afternoon of Friday, October 23, took the File Manager servers offline and fixed the vulnerability. Its investigation is ongoing.
The attacker obtained FTP and SFTP usernames and passwords for users who logged in to File Manager before October 23. DreamHost said the attacker also reached certain webmail systems and took login credentials for a limited number of webmail users. The company said it has no evidence so far that control panel logins or billing details were accessed.
DreamHost's spokesperson said that the number of affected customers is “well under 10%” but would not provide a more accurate figure. The web host touts some 400,000 paying customers across its network. DreamHost says it addressed the vulnerability, ended potentially affected users' active sessions and reset passwords.
DreamHost declined to say why it did not detect the attack sooner, so it is unclear why the problem was found only on October 23 when the attack reportedly began in August. The company says it is notifying regulators and that the incident is not related to recent PHP server updates.
