Web host DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. TechCrunch reports that the company disclosed the breach last Thursday after it sparked an outage spanning several days.
Key takeaways
- The cyberattack on DreamHost began in August and lasted for months.
- Hackers stole customer emails, credentials, and session tokens.
- The attackers exploited an unspecified vulnerability in the company file manager.
- DreamHost stated that the affected customer count is well under 10 percent of its user base.
What caused the Dreamhost data breach?
According to a data breach notice filed with California’s attorney general, the attack started in August. The breach allowed hackers to obtain session tokens, which keep users logged in after they enter passwords. If stolen, attackers can break into a system as if they were that specific user. The web host stated that hackers exploited an unspecified vulnerability in its file manager, a tool customers use to store their files.
Web host hacked in months-long incident
When reached by TechCrunch, a DreamHost spokesperson declined to explain why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson also did not reveal the exact nature of the vulnerability. However, the company noted that the security incident was unrelated to vulnerabilities recently discovered in PHP web software.
The web host touts around 400,000 paying customers across its network. While the spokesperson stated that the number of affected users is well under 10%, the company would not provide a more precise figure. During the multi-day outage that followed the discovery, the company reset some customer passwords.
What happens next?
DreamHost continues to investigate the cyberattack with ongoing scrutiny from officials. Customers affected by the incident face potential risks regarding their stolen inboxes and credentials. The company has not yet provided a detailed timeline for when its internal investigation will conclude or if additional security measures will be deployed.
Frequently asked questions
According to the company notice filed with California's attorney general, the attack began in August.
Hackers stole customer emails, credentials, and session tokens which allow unauthorized access to user accounts.
DreamHost stated that the number of affected customers is well under 10% of its roughly 400,000 paying customers.
No, DreamHost stated that the security breach was unrelated to vulnerabilities recently discovered in PHP web software.
A DreamHost spokesperson declined to say why the company did not detect the incident until last week, citing an ongoing investigation.
Based on reporting by TechCrunch. Read the original article
