DreamHost confirms hackers stole customer emails and files

Summarised from TechCrunch's report · Updated 5 Nov, 09:48 · Archive

Web host DreamHost confirmed hackers stole customer emails and credentials during a months-long cyberattack that began in August.

Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack. The attack began in August and was discovered last week after it caused a multi-day outage. The company reset some customer passwords following the discovery.

Hackers exploited an unspecified vulnerability in DreamHost's file manager, which customers use to store files. The breach allowed attackers to obtain session tokens that keep users logged in after entering their passwords, potentially letting hackers access systems as if they were the user. DreamHost said the attack was unrelated to recent vulnerabilities in PHP web software.

DreamHost declined to explain why it did not detect the attack until last week, citing an ongoing investigation. The company said fewer than 10 per cent of its roughly 400,000 paying customers were affected but would not provide a more precise figure.

Read the report

• Hackers stole DreamHost customer files and inboxes during months-long attackThe web host said hackers exploited a vulnerability to access customer emails and files during a "deliberate attack."TechCrunch · 4 Nov, 20:36

In this story: DreamHost · California · TechCrunch

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log