DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. The web host disclosed the breach last Thursday after it caused a multi-day outage, during which DreamHost reset some customer passwords.
The attack began in August, according to a data breach notice DreamHost filed with California's attorney general. Hackers exploited an unspecified vulnerability in DreamHost's file manager to obtain session tokens, which allow users to remain logged in after entering their passwords. Session tokens can let attackers access systems as if they were the legitimate user.
DreamHost declined to explain why it did not detect the cyberattack until last week, citing an ongoing investigation. The company also did not disclose what the vulnerability was. It said the breach was unrelated to vulnerabilities recently discovered in PHP web software.
DreamHost's spokesperson said the number of affected customers is "well under 10%" but would not provide a more specific figure. The web host operates some 400,000 paying customers across its network.