DreamHost suffered a months-long breach where hackers stole customer files and emails via a file manager vulnerability. The company reset passwords and disclosed the incident.
DreamHost Discloses Breach After Outage
Web hosting provider DreamHost has confirmed that hackers stole customer emails and credentials during a cyberattack that persisted for months. The company disclosed the breach last Thursday, following an outage that lasted several days and prompted password resets for some customers.
In a data breach notice filed with California's attorney general, DreamHost said the attack began in August and allowed hackers to obtain session tokens—the digital keys that keep users logged in after they enter their passwords. With these tokens, attackers can bypass authentication and access accounts as if they were the legitimate user.
Vulnerability in File Manager Exploited
The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, a tool customers use to store and manage their files. When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson also did not disclose the nature of the vulnerability but stated that it was unrelated to the recent vulnerabilities discovered in the PHP web software.
DreamHost's spokesperson said the number of affected customers is "well under 10%" but would not provide a more precise figure. The web host claims approximately 400,000 paying customers across its network, meaning the breach could have impacted tens of thousands of accounts.
Technical Details and Implications
Session tokens are a common target for attackers because they can provide persistent access without needing to steal passwords. Once obtained, tokens can be used to impersonate users and access sensitive data, including emails and files. The fact that the attackers exploited a vulnerability in the file manager suggests a flaw in the application's authentication or authorization mechanisms.
DreamHost has not yet revealed whether the stolen data has been misused or if customers are at risk of further attacks. The company has reset passwords for affected accounts as a precautionary measure.
Industry Context and Response
This breach highlights the growing threat of cyberattacks targeting web hosting providers, which store vast amounts of sensitive customer data. The months-long duration of the attack raises questions about DreamHost's security monitoring and incident response capabilities.
"The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, which customers use to store their files."
DreamHost's disclosure comes amid increased scrutiny of cybersecurity practices in the tech industry. Customers are advised to monitor their accounts for suspicious activity and enable two-factor authentication where possible.
As the investigation continues, DreamHost faces the challenge of restoring customer trust and ensuring that similar vulnerabilities are addressed promptly.