Website hosting provider DreamHost has confirmed that hackers stole customers' emails and credentials during a series of cyberattacks on their system that lasted for several months. DreamHost disclosed this intrusion incident last Thursday; prior to that, the incident caused several days of service interruptions, during which the company reset the passwords of some customers.
In a data breach notification submitted to the California Attorney General, this website hosting provider stated that the attack began in August, during which hackers obtained session tokens. Session tokens allow users to remain logged in after entering their passwords; if stolen, hackers can access the system just as if they were the users themselves. The company claimed that hackers exploited an unspecified vulnerability in the DreamHost file manager, which customers used to store files.
In response to a question from TechCrunch, the spokesperson, identified as DreamHost, stated that since the investigation is still ongoing, the company is reluctant to explain why they only discovered this cyberattack last week. The spokesperson also did not specify what the exact vulnerability was. The company emphasized that this incident is unrelated to the vulnerabilities recently found in the PHP network software.
The spokesperson also stated that the number of affected customers is "far less than 10%", but did not provide a more precise figure. This website hosting provider claims to have approximately 400,000 paying customers in its network.
