They Were Inside DreamHost Since August. The Passwords Were the Least of It

A web host found an intruder in its file manager on October 23 — three months after the break-in began. What the attacker took wasn't just passwords. It was the sessions themselves.