DreamHost

Summary

DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack that exploited an unspecified vulnerability in its file manager and obtained session tokens, allowing intruders to access accounts as if they were legitimate users. The breach triggered a multi-day outage and forced password resets for some customers, with the company stating that affected accounts represent well under 10 percent of its roughly 400,000 paying customers.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. The web host disclosed the breach last Thursday after the incident sparked an outage that spanned several days. During the outage, DreamHost reset some customer passwords. In a data breach notice filed with California’s attorney general, the company stated that the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after entering their passwords. If stolen, those session tokens can allow hackers to break into a system as if they were the legitimate user. The company said hackers exploited an unspecified vulnerability in DreamHost’s file manager, which customers use to store their files. When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson also did not say what the vulnerability is. DreamHost stated that the incident was unrelated to the vulnerabilities recently discovered in the PHP web software.

DreamHost’s spokesperson said that the number of affected customers is “well under 10%” but would not provide a more accurate figure. The web host touts some 400,000 paying customers across its network. The breach notice and public disclosure came after the several-day outage had already disrupted service. The company’s statement confirmed that customer emails and credentials were among the data taken by the attackers. No further details about the specific vulnerability or the timeline of detection were made available by the spokesperson. The investigation into the attack remains ongoing.

Sources

Sources available to members: 1 source.