Web hosting provider DreamHost has disclosed that unauthorized actors accessed customer files and email inboxes during a sustained intrusion spanning several months. In a statement, the company said the attackers exploited a vulnerability in its systems to carry out what it described as a deliberate attack, gaining entry to stored data belonging to an unspecified number of customers. DreamHost indicated that it identified the activity, moved to close the exploited flaw, and has begun notifying affected account holders. The company did not immediately specify how many customers were impacted or precisely when the breach began and was contained.
The disclosure adds DreamHost to a growing list of hosting and cloud service providers confronting security incidents that expose sensitive customer information, including private correspondence and stored files. Such providers occupy a sensitive position in the digital supply chain, holding data for businesses and individuals who rely on them for email and website operations. DreamHost said it is cooperating with investigators and has urged customers to review their account security, including enabling multi-factor authentication and monitoring for suspicious activity. Security experts note that compromised inboxes can serve as entry points for further attacks, including password resets and phishing campaigns targeting contacts.
Independent reporting synthesized from primary wires and global correspondents.