Key facts
- DreamHost said hackers obtained session tokens, which keep users logged in after entering their passwords.
- The attackers exploited an unspecified vulnerability in DreamHost's file manager, the company said.
- DreamHost said the incident was unrelated to recently discovered vulnerabilities in the PHP web software.
- A DreamHost spokesperson said affected customers number "well under 10%" of its paying customers.
Web host DreamHost said hackers stole customer emails and credentials during a cyberattack that began in August, according to a data breach notice the company filed with California's attorney general. DreamHost disclosed the breach on October 29 after it caused an outage that spanned several days, during which the company reset some customer passwords.
In the filing, DreamHost said the attackers obtained session tokens, which keep users logged in after they enter their passwords. A stolen token lets an attacker enter a system as if they were that user. DreamHost said the hackers exploited an unspecified vulnerability in its file manager, the tool customers use to store their files.
A DreamHost spokesperson declined to say why the company did not detect the attack until last week, citing an ongoing investigation, and did not identify the vulnerability. The company said the incident was unrelated to vulnerabilities recently found in the PHP web software.
The spokesperson said the number of affected customers is "well under 10%" but would not give a more precise figure. DreamHost says it has about 400,000 paying customers across its network.