The key facts

  • The attack began in August and was only detected at the end of October — after an outage lasting several days
  • Hackers exploited an unspecified vulnerability in the file manager and stole session tokens, which grant access to accounts without a password
  • 'Noticeably less than 10%' of customers were affected; some passwords were reset

What happened

Hosting provider DreamHost has confirmed that hackers stole customer emails and credentials during a months-long attack. The company announced the breach last Thursday, after the incident caused a service outage lasting several days; during that period, DreamHost reset the passwords of some customers. This was reported by TechCrunch.

How the attack worked

In a data breach notification filed with the California Attorney General, the company said the attack began in August. The attackers obtained session tokens — elements that keep users logged in after they enter their password; once in possession of these tokens, hackers can access an account as if they were the owner themselves. The intrusion occurred through an unspecified vulnerability in DreamHost's file manager, which customers use to store their files.

What remains unknown

In response to questions from TechCrunch, a DreamHost representative declined to explain why the attack was not detected until last week, citing an ongoing investigation, and did not name the specific vulnerability. The company only stated that the incident is not related to recently discovered vulnerabilities in the PHP web platform. The representative estimated the number of affected customers as 'noticeably less than 10%', but did not give an exact figure; DreamHost itself says it has approximately 400,000 paying customers on its network.