Web hosting provider DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack that the company apparently noticed only when things started visibly falling apart. The breach was disclosed last Thursday after it triggered an outage spanning several days, during which DreamHost reset some customer passwords - a classic "we've fixed it, please don't ask how long it was broken" maneuver.

In a data breach notice filed with California's attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, the digital wristbands that keep users logged in after they enter their passwords. With those tokens in hand, an attacker can waltz into a system pretending to be the legitimate user, no password required - which is exactly as convenient for hackers as it sounds and exactly as inconvenient for everyone else.

The company said hackers exploited an unspecified vulnerability in DreamHost's file manager, the tool customers use to store their files. When reached by TechCrunch, a DreamHost spokesperson declined to explain why the company didn't detect the cyberattack until last week, citing an ongoing investigation - a phrase that has never once made anyone feel better about a four-month detection gap. The spokesperson also declined to say what the vulnerability actually is.

DreamHost did offer one clarification: the flaw was unrelated to the vulnerabilities recently discovered in the PHP web software, because apparently it's important to establish that this particular fire was not caused by the other, more famous fire.

As for how many customers were affected, the spokesperson said the number is "well under 10%" but would not provide a more accurate figure. For context, DreamHost touts some 400,000 paying customers across its network - so "well under 10%" is a reassuringly vague way of saying "a number large enough that we'd rather you didn't do the math."