Web host DreamHost has confirmed that hackers stole customer emails and credentials during a months-long cyberattack on its systems. DreamHost disclosed the breach last Thursday after it sparked an outage that spanned several days, during which it reset some customer passwords.

In a data breach notice filed with California’s attorney general, the web host said the attack began in August and allowed hackers to obtain session tokens, which keep users logged in after entering their passwords. If stolen, hackers can break into a system as if they were that user. The company said hackers exploited an unspecified vulnerability in DreamHost’s file manager, which customers use to store their files. 

When reached by TechCrunch, a DreamHost spokesperson declined to say why the company did not detect the cyberattack until last week, citing an ongoing investigation. The spokesperson did not say what the vulnerability is. The company said it was unrelated to the vulnerabilities recently discovered in the PHP web software.

DreamHost’s spokesperson said that the number of affected customers is “well under 10%” but would not provide a more accurate figure. The web host touts some 400,000 paying customers across its network.