EXPLORINEER
en

US — TechCrunch

Hackers stole DreamHost customer files and inboxes during months-long attack

Security1 min read

Web host DreamHost says hackers stole customer emails and login details during a cyberattack that lasted for months. The company only found the attack last week, after an outage lasting several days.

What happened

DreamHost, a company that hosts websites and stores files online, confirmed that hackers took customer emails and credentials. The attack started in August. The hackers got session tokens, which are small pieces of data that keep a user logged in after they type their password. With a stolen token, a hacker can act like the real user. DreamHost said the hackers used a weakness in its file manager, the tool customers use to store files. The company did not say what the weakness is.

Key facts

  • The attack began in August and went on for months.
  • DreamHost announced the breach last Thursday.
  • The company says "well under 10%" of customers were affected, but did not give an exact number.
  • DreamHost says it has some 400,000 paying customers.

Why the outage matters

The breach came out after an outage that lasted several days. During this time, DreamHost reset some customer passwords. A password reset is a common step after a security problem, because it locks out anyone who may have taken the old password.

Why it matters

Stolen emails and login tokens can give hackers access to private information and accounts. The fact that the company did not notice the attack for months is also a concern. Customers who use DreamHost may want to check their accounts and be careful about suspicious emails.

What to watch

  • How many customers were actually affected. DreamHost has not given an exact number.
  • What the file manager weakness is, once the investigation is finished.
  • Why the attack was not found until last week.
  • Whether DreamHost gives more details in its data breach notice or to customers.

Glossary

DreamHost
A company that hosts websites and offers online file storage and email for customers.
session tokens
Small pieces of data that keep a user logged in, so they do not have to type their password again.
file manager
A tool that lets customers store, open, and organize their files online.
data breach notice
An official report a company files when customer data may have been stolen.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityArs Technica

Binance says hackers who stole billions in crypto spent months planning heist

Binance said the hackers behind the theft spent months on the attack, using social engineering and novel malware, and that the campaign began no later than June and ended last Thursday with the compromise of an engineer's laptop. The FBI and TRM Security attributed the heist to North Korean actors, which initially targeted $6.34 billion from Binance wallets. Binance said it has frozen or intercepted $2.85 billion of that sum and has set aside funds to cover the loss.

SecurityITmedia

Muji's MUJI Card Full Card Numbers, About 1.09 Million Records Possibly Leaked in Unauthorized Access Follow-Up

Ryohin Keikaku said credit card information, names, and addresses that it had initially excluded may also have been accessed by outsiders in the unauthorized access to its MUJI app. Newly identified data includes about 1.09 million member records for the MUJI Card, covering full card numbers, MUJI Card IDs, and birth dates, of which about 345,000 cards remain valid.

Security전자신문

Tilon's Dstation X Obtains NIS Security Function Verification Certificate, Clearing Public-Sector Adoption Requirements

VDI company Tilon said its next-generation platform Dstation X (v10.0) has received a security function verification certificate from the National Intelligence Service under its security function testing system. With this, Dstation X has completed quality certification, a procurement channel on the Digital Service Mall, and security verification required for public-sector adoption. Agencies adopting the product can skip the separate security conformity verification process.

SecurityITmedia

Chinese Manufacturer Allegedly Installed Criminal Backdoor on Android Devices Before Shipment; Google Cuts Ties

Google said on November 3 (local time) that more than 1.3 million devices, mainly Android TV set-top boxes, were infected with malware made by Chinese OEM/ODM maker Videostrong Technology, which sold remote access to criminals. Google ended its relationship with the company, barred it from making Google-certified Android devices and supplying software to other certified makers, and disrupted the botnet with law enforcement and security partners, including Japan's National Police Agency.