THE CRUNCH
DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack that began in August. The company disclosed the breach last Thursday after it caused an outage lasting several days, during which it reset some customer passwords.
In a breach notice filed with California's attorney general, DreamHost said the attackers exploited an unspecified vulnerability in its file manager, the tool customers use to store files, and obtained session tokens, which keep users logged in after they enter a password. Stolen tokens let an attacker break into a system as if they were that user.
The company said affected customers number "well under 10%" of the roughly 400,000 paying customers on its network, but declined to give a more precise figure. A spokesperson also would not say what the vulnerability is or why the attack went undetected until last week, citing an ongoing investigation. DreamHost said the flaw is unrelated to vulnerabilities recently discovered in the PHP web software.