Web hosting provider DreamHost has confirmed that hackers gained access to customer emails, credentials and session tokens during a cyberattack that began in August and went undetected for months, the company disclosed last Thursday after the attack sparked an outage that spanned several days.
DreamHost, which hosts websites for some 400,000 paying customers, said the attackers exploited an unspecified vulnerability in its file manager, a tool customers use to store files. The breach allowed hackers to obtain session tokens, which keep users logged in after they enter their passwords.
The web host disclosed the incident in a data breach notice filed with California’s attorney general and said it reset some customer passwords during the outage. The company told TechCrunch that the number of affected customers is “well under 10%” of its customer base but declined to provide a more precise figure.
DreamHost said the attack, which began in August, was unrelated to the vulnerabilities recently discovered in the PHP web software. The company did not say why the intrusion was not detected until last week, and a spokesperson declined to elaborate, citing an ongoing investigation. The spokesperson also did not say what the file manager vulnerability was.
Analysis
Why This Matters
- Web hosting breaches expose customer data, including emails and login credentials, which can be used for phishing and account takeovers.
- Session token theft allows attackers to bypass password protections and impersonate users without needing a password.
- The months-long undetected access raises questions about the detection and response capabilities of managed hosting providers.
Background
DreamHost is a Los Angeles-based web hosting company that serves both individuals and businesses. The breach is the latest in a series of compromises at major web hosts, where the concentration of customer data makes them attractive targets for attackers.
Key Perspectives
What to Watch
- Whether DreamHost will disclose the specific file manager vulnerability or release a patch.
- Potential follow-up investigations by California’s attorney general or other regulators.
- Whether affected customers report secondary fraud or account compromise linked to the stolen session tokens.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedDreamHost said affected customers were “well under 10%” of its customer base and would not give a more precise figure.TechCrunch: “DreamHost’s spokesperson said that the number of affected customers is “well under 10%” but would not provide a more accurate figure.”
- SupportedDreamHost confirmed hackers stole customer emails and credentials.TechCrunch: “Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems.”
- SupportedHackers stole session tokens.TechCrunch: “In a data breach notice filed with California’s attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens”
- SupportedThe attack began in August and went undetected for months.TechCrunch: “the web host said the attack began in August”
- Partly supportedThe outage began last week.TechCrunch: “DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days”
- SupportedDreamHost disclosed the breach last Thursday after the attack sparked an outage that lasted several days.TechCrunch: “DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days”
- SupportedAttackers exploited an unspecified vulnerability in DreamHost’s file manager.TechCrunch: “The company said hackers exploited an unspecified vulnerability in DreamHost’s file manager, which customers use to store their files.”
- SupportedDreamHost hosts websites for about 400,000 paying customers.TechCrunch: “The web host touts some 400,000 paying customers across its network.”
- SupportedDreamHost filed a data-breach notice with California’s attorney general.TechCrunch: “In a data breach notice filed with California’s attorney general”
- SupportedDreamHost reset some customer passwords during the outage.TechCrunch: “during which it reset some customer passwords.”
- SupportedDreamHost said the attack was unrelated to recently discovered vulnerabilities in PHP web software.TechCrunch: “The company said it was unrelated to the vulnerabilities recently discovered in the PHP web software .”
- SupportedA DreamHost spokesperson declined to say why the attack was not detected until last week, citing an ongoing investigation.TechCrunch: “When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation.”
