Hackers stole DreamHost customer files and emails in months-long attack

DreamHost confirmed that hackers accessed customer emails and credentials during a cyberattack lasting several months, according to TechCrunch.

The attack began in August and involved exploitation of a vulnerability in DreamHost's file manager, which customers use to store files, the company disclosed in a breach notice filed with California's attorney general.

Hackers obtained session tokens that allow them to stay logged in as users without needing passwords, enabling unauthorized access to accounts.

The breach caused a multi-day outage and prompted DreamHost to reset some customer passwords. The company said fewer than 10% of its approximately 400,000 paying customers were affected but did not provide a precise figure.

A DreamHost spokesperson declined to specify the vulnerability or explain why the attack was not detected earlier, citing an ongoing investigation. The company confirmed the vulnerability was unrelated to recent PHP web software issues.