---
title: "DreamHost File Manager and webmail incident"
description: "DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/dreamhost-file-manager-and-webmail-incident-2026"
markdown_url: "https://www.ally.security/incidents/dreamhost-file-manager-and-webmail-incident-2026.md"
stix_url: "https://www.ally.security/incidents/dreamhost-file-manager-and-webmail-incident-2026/stix.json"
---

# DreamHost File Manager and webmail incident

DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Web-based File Manager and some webmail systems
- **Operational impact:** FTP/SFTP credentials and possible webmail sessions exposed
- **Financial impact:** No incident cost disclosed

## What happened

[DreamHost](https://www.dreamhost.com/) disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026. [1](#source-1)

## Impact

The attacker also reached some webmail systems, potentially exposing session credentials, email contents and files. DreamHost found no evidence of control-panel login or billing-data access as of its notice. [1](#source-1)

## Timeline

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

DreamHost identified a vulnerability in the File Manager software but did not name a CVE or establish the attacker’s identity. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

DreamHost stopped access, addressed the vulnerability, terminated affected sessions and reset passwords. It engaged outside forensic specialists and offered a year of identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/dreamhost-file-manager-and-webmail-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### DreamHost data security notice

official · DreamHost

<https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   DreamHost File Manager and webmail incident: DreamHost stopped access, addressed the vulnerability, terminated affected sessions and reset passwords. It engaged outside forensic specialists and offered a year of identity protection.
2. **Resulted In · 100% confidence · current**  
   DreamHost File Manager and webmail incident: DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026.
3. **Resulted In · 100% confidence · current**  
   DreamHost File Manager and webmail incident: The attacker also reached some webmail systems, potentially exposing session credentials, email contents and files. DreamHost found no evidence of control-panel login or billing-data access as of its notice.
4. **Resulted In · 100% confidence · current**  
   DreamHost File Manager and webmail incident: DreamHost identified a vulnerability in the File Manager software but did not name a CVE or establish the attacker’s identity.
5. **Affected Organization · 100% confidence · current**  
   DreamHost File Manager and webmail incident: DreamHost

</details>