Incident BriefingsDreamHost File Manager and webmail incident

DreamHost File Manager and webmail incident

DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026.

Last modified

Summary

  • Environment: Web-based File Manager and some webmail systems
  • Operational impact: FTP/SFTP credentials and possible webmail sessions exposed
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.

What happened

DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026. [1]

Impact

The attacker also reached some webmail systems, potentially exposing session credentials, email contents and files. DreamHost found no evidence of control-panel login or billing-data access as of its notice. [1]

Timeline

  1. Briefing updated

    This briefing was last reviewed and updated on November 4, 2026.

Threat Group & Attack Vector

DreamHost identified a vulnerability in the File Manager software but did not name a CVE or establish the attacker’s identity. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

DreamHost stopped access, addressed the vulnerability, terminated affected sessions and reset passwords. It engaged outside forensic specialists and offered a year of identity protection. [1]