DreamHost breach ran undetected from August, exposing customer emails and files

What happened

Web hosting company DreamHost has confirmed that attackers took customer email and login credentials in an intrusion that went on for months, TechCrunch reported. The company made the breach public last Thursday, after the incident triggered a multi-day outage during which DreamHost reset passwords for some of its customers.

According to a breach notice DreamHost submitted to California's attorney general, the attack started in August. The intruders took advantage of a flaw in the company's file manager, the tool customers use to store their files, and were able to obtain session tokens. DreamHost has not publicly identified the vulnerability.

A DreamHost spokesperson would not explain why the company only detected the attack last week, pointing to an investigation that is still underway. The spokesperson said the share of affected customers was well below 10 percent but declined to give a more precise figure.

Context

DreamHost says it has about 400,000 paying customers across its network, so even a share below 10 percent could involve a sizable number of accounts. The company said the flaw behind this attack is unrelated to the vulnerabilities recently found in PHP web software, and it has withheld further technical details while its investigation continues.