Hackers stole DreamHost customer files and inboxes during months-long attack

Your login credentials for DreamHost may have been exposed, requiring a password reset and vigilance against phishing attempts.

Web host DreamHost has confirmed a cyberattack that compromised customer emails and credentials. The breach, which began in August and lasted for months, was only disclosed last Thursday after causing several days of outage and requiring some customer password resets. Hackers exploited an unknown vulnerability in DreamHost's file manager, gaining access to session tokens that allowed them to impersonate users. The company stated that fewer than 10% of its approximately 400,000 paying customers were affected, but declined to provide specific numbers or details about the exploited vulnerability due to an ongoing investigation. The vulnerability is reportedly unrelated to recent PHP web software flaws.

The prolonged duration of the attack and the exploitation of a file manager vulnerability suggest a sophisticated threat actor potentially targeting sensitive customer data. DreamHost's delayed disclosure, only surfacing after a significant outage, raises questions about their internal security monitoring and incident response capabilities. The use of session tokens as a vector indicates a focus on persistent access rather than immediate data exfiltration, suggesting a potential for deeper compromise or lateral movement within affected accounts.

This incident underscores the persistent risks associated with web hosting providers, as they manage critical infrastructure for a vast number of users and businesses. The compromise of session tokens, in particular, highlights the increasing sophistication of attacks that bypass traditional authentication. Customers should consider multi-factor authentication for all services and remain hyper-vigilant regarding any suspicious communications or login prompts, even after password resets.