DreamHost recently revealed that it suffered a cyberattack lasting several months, during which hackers accessed customer emails and files by exploiting a vulnerability in the company’s file manager. The breach came to light last week after DreamHost experienced an extended outage that forced it to reset some user passwords. This incident allowed attackers to steal session tokens, which could enable unauthorized access to customer accounts without needing passwords.

The attack began in August and affected fewer than 10% of DreamHost’s roughly 400,000 paying customers, though the company has not specified the precise number. The stolen session tokens allowed hackers to impersonate users and infiltrate their inboxes and stored files. While DreamHost disclosed the breach through a notice filed with California’s attorney general, it has withheld specific details about the exploited vulnerability, citing an ongoing investigation.

A DreamHost spokesperson clarified that the flaw exploited by the hackers is unrelated to recent critical security issues found in PHP web software. The company also declined to explain why the attack went undetected for so long. DreamHost has acknowledged the severity of the breach and emphasized that it is working to strengthen its security measures in response.

This incident highlights the continuing risks web hosting services face from persistent, sophisticated cyberattacks. Customers affected by the breach are advised to review their account activity and update passwords where necessary. As DreamHost investigates further, the broader tech community will be watching closely to see how the company mitigates potential fallout and prevents similar incidents going forward.