ewsba.se
Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days, during which it reset some customer passwords.
In a data breach notice filed with California’s attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after entering their passwords. If stolen, hackers can break into a system as if they were that user. The company said hackers exploited an unspecified vulnerability in DreamHost’s file manager, which customers use to store their files.
When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson did not say what the vulnerability is. The company said it was unrelated to the vulnerabilities recently discovered in the PHP web software.
DreamHost’s spokesperson said that the number of affected customers is “well under 10%” but would not provide a more accurate figure. The web host touts some 400,000 paying customers across its network.
Buy One Pass, Get a Second FreeCover more ground at TechCrunch’s ultimate founder bootcamp of the year by bringing your co-founder or partner for freeBook before the BOGO deal expires
Every weekday and Sunday, you can get the best of TechCrunch’s coverage.
TechCrunch Mobility is your destination for transportation news and insight.
Startups are the core of TechCrunch, so get our best coverage delivered weekly.
Provides movers and shakers with the info they need to start their day.
By submitting your email, you agree to our Terms and Privacy Notice.