Hackers Spent Months Inside DreamHost's Systems and Took Customers' Email and Files: Why Nobody Noticed Since August, the Company Won't Say

DreamHost, an American web hosting company, has confirmed that hackers stole customers' emails and login data in an attack that lasted for months. The attack began in August, and the company disclosed it only toward the end of October, after it caused an outage that lasted several days and during which some customers' passwords were reset.

According to the data breach notice the company filed with the California attorney general, the attackers obtained session tokens - the small digital keys that keep you logged in after you have already entered your password. With a stolen token, a hacker walks into the system as if they were the user. They got in through an unnamed vulnerability in DreamHost's file manager, exactly the place where customers keep their files.

That is where the answers stop. A company spokesperson declined to say why the attack went unnoticed until last week, citing the ongoing investigation. Nor did they say what the vulnerability is, other than that it has nothing to do with recently discovered flaws in PHP software. How many customers are affected? "Well under 10 percent," says DreamHost, and nothing more precise.

The company boasts about 400,000 paying customers. Ten percent of them is 40,000 people - that is the upper limit the company leaves open.

For months someone was reading other people's mail and searching through customers' files, and the firm that charges precisely for keeping those files safe is the last to find out. How many small businesses, including ones from the Balkans, keep their websites with foreign hosting companies - and how many of them would ever learn their mail had been opened, if the host didn't tell them itself?