Session Hijack: Hackers Raid DreamHost Customer Inboxes and Files in Months-Long Breach

Major web hosting provider DreamHost confirmed that malicious hackers breached its internal infrastructure, stealing private customer emails, user credentials, and stored file data during a months-long cyberattack. The company disclosed the security incident after a multi-day network outage triggered widespread system resets and forced engineers to issue mandatory password resets across customer accounts.

According to an official data breach notice filed with the California Attorney General’s office, the intruder activity began back in August. Attackers compromised internal systems to steal active session tokens, which allow users to remain logged into online accounts without re-entering passwords. By hijacking valid session tokens, the hackers bypassed standard authentication barriers and accessed administrative accounts as if they were legitimate site owners. The company revealed that attackers exploited an undisclosed software vulnerability inside DreamHost’s proprietary file manager tool, which clients use to manage and store website assets.

When questioned directly about the timeline, a DreamHost representative declined to explain why security operations failed to detect the intrusion for several months, citing an active investigation. The spokesperson also withheld specific details regarding the exact flaw exploited in the file manager, stating only that the bug was completely separate from recently reported security issues in PHP web software.

DreamHost claims that the breach affected well under 10 percent of its client base, though company officials refused to release exact figures. With over 400,000 paying subscribers across its global hosting network, even a single-digit percentage hit leaves tens of thousands of business owners, site managers, and personal users exposed. Compromised data includes sensitive inbox communications, private account credentials, and file directories hosted across DreamHost servers.

Stolen session tokens pose severe long-term risks for website owners. Unlike standard password theft, session token hijacking allows bad actors to bypass multi-factor security checks entirely. Once inside a file manager interface, attackers can insert malicious code into live web pages, download private customer databases, or modify internal configuration files without triggering standard intrusion alerts.

Security experts recommend that all DreamHost subscribers take immediate defensive steps. Account owners should invalidate all active login sessions, reset administrative passwords, and audit hosted file directories for unauthorized file additions. Additionally, site managers running customer databases or processing online payments must check email logs for unauthorized access and review active FTP accounts to ensure overall system integrity.

The months-long breach highlights the growing danger facing central web hosting platforms. When a core hosting provider suffers a major security breakdown, thousands of downstream client websites become vulnerable to lateral attack. Moving forward, web hosts must improve continuous internal network monitoring, harden proprietary management software, and patch file storage systems quickly to catch active intruders before data theft spreads across user networks.