Hackers stole DreamHost customer files and inboxes during months-long attack

Web host DreamHost has confirmed that hackers stole customer emails and credentials during a cyberattack on its systems that lasted months. DreamHost disclosed the breach last Thursday after it triggered an outage that spanned several days, during which it reset some customer passwords.

In a data breach notice filed with California's attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after they enter their passwords. If stolen, hackers can break into a system as if they were that user. The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, which customers use to store their files.

When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson did not say what the vulnerability is. The company said it was unrelated to the vulnerabilities recently discovered in the PHP web software.

DreamHost's spokesperson said the number of affected customers is "well under 10%" but would not provide a more accurate figure. The web host says it has some 400,000 paying customers across its network.