Hackers stole customer files and inboxes from web host DreamHost during an attack that ran for months before anyone noticed. The company confirmed the breach to TechCrunch on 4 November, after disclosing it to customers the previous week. Attackers exploited a vulnerability in the company's web-based File Manager and stayed inside its systems from August until 23 October. DreamHost says the number of affected customers is well under 10 percent of its roughly 400,000 paying customers.
The attack began in August, according to a breach notice DreamHost filed with the California attorney general. The notice says an unauthorised party exploited an unspecified vulnerability in the software behind the File Manager, at files.dreamhost.com, and obtained the FTP and SFTP usernames and passwords of people who logged in during that window. The intruder also reached certain webmail systems, which may have exposed session information, including credentials, for a limited number of webmail users. In a small number of cases, mailbox contents may have been viewed.
DreamHost found the breach on 23 October
The company found the problem on the afternoon of Friday 23 October, took the File Manager servers offline and fixed the vulnerability. The disclosure came last Thursday, after an outage that spanned several days, during which the company reset some customer passwords. A spokesperson declined to say why the company did not detect the attack until last week, citing an ongoing investigation. The investigation is still going, and the company has not said how the intruder got in beyond the File Manager flaw.
The data taken puts website owners at direct risk. With valid FTP credentials, an attacker can read or change website content, and with a stolen webmail session token, an attacker can open a mailbox without a password. The notice lists username, password, email contents and files stored on the FTP server among the data that may have been accessed. Customers who logged in to the File Manager between August and 23 October are the ones affected, and the company has told them to reset their FTP, SFTP and email passwords, check their sites for files they did not put there, and turn on multi-factor authentication where it is offered.
DreamHost says billing details were not taken
The company says it found no evidence that the attacker accessed control panel login information or customer billing and payment details. It adds that it does not store full card numbers, and that payment information is handled by an external provider. The company also says the breach is not related to recent PHP server updates. Affected customers have been offered one year of credit monitoring and identity-theft protection. The company terminated active sessions for users who may have been affected and reset their passwords.
The scale of the breach is still unclear. DreamHost has not given an exact number of affected customers, and the California filing gives no count. The sample letter posted with the filing leaves the number of Rhode Island residents as a placeholder. What is known is the share: well under 10 percent of the customer base, against about 400,000 paying customers across the network. That puts the number below 40,000, though the company has not confirmed a figure and the true number could be far smaller.
DreamHost breach went undetected for two months
The hardest question for the company is why the intrusion went undetected for about two months. The spokesperson would not answer it, and the company has pointed only to its ongoing investigation. The gap matters because session tokens let an attacker skip past passwords, and two months of access gave the intruder time to collect credentials as customers logged in. The company blocked the attacker's access, addressed the vulnerability and stopped active sessions for potentially affected users once it found the problem on 23 October.
Customers who hosted with DreamHost during the window should act even if they have not heard from it. The advice from the company's own notice is to change FTP, SFTP and webmail passwords, review inbox activity, and check sites for unauthorised changes. The breach notice was listed by the California attorney general on 2 November, and the company says it is notifying regulators. Until the investigation closes, the open question is how many customers were hit and whether the stolen credentials have been used anywhere else.