{
  "type": "bundle",
  "id": "bundle--615203da-844f-5e6b-8efe-5699a9cfc2ef",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--4575eb71-a0ef-5286-8971-0fc2ce2ea424",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "org:ac484895-b3ae-435e-bee7-c7ad9de6ab2f",
      "name": "DreamHost",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--63e7060d-93a9-5fd8-80b1-be28671e9471",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "inc:e516e007-9426-4cf3-b24f-92896fb5700c",
      "name": "DreamHost File Manager and webmail incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7d114bf7-d197-55da-86fd-39595af2346a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "brh:b6985f77-1b83-4a25-a1e2-7fcf0295275a",
      "name": "DreamHost File Manager and webmail incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f378790b-b32b-5383-8fd2-290ebf0f39f1",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:9a7837d2-5585-4d02-bbaf-44c6d2a18099",
      "relationship_type": "affected-organization",
      "source_ref": "incident--63e7060d-93a9-5fd8-80b1-be28671e9471",
      "target_ref": "identity--4575eb71-a0ef-5286-8971-0fc2ce2ea424",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "DreamHost",
          "url": "https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf",
          "external_id": "cit:874cac06-cc4f-4103-ac27-21cba7a82560",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94da8c615045093b4af34b2f37ae8dc0db25c7f1b60d46db4cfaaa3cf0a113e6"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--062f14ff-14ed-5994-8fe7-0098c9007382",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:12b73a5f-b7df-415d-ada6-3b5ab40bc142",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "DreamHost",
          "url": "https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf",
          "external_id": "cit:62830fb2-59ff-448b-bdb1-9d9daac6c348",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94da8c615045093b4af34b2f37ae8dc0db25c7f1b60d46db4cfaaa3cf0a113e6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The attacker also reached some webmail systems, potentially exposing session credentials, email contents and files. DreamHost found no evidence of control-panel login or billing-data access as of its notice."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2d2e2b8b-5b6c-5c22-8a7c-1814f80e8d9a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:11f8028a-5c38-476c-b15f-caab89d0fb9d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "DreamHost",
          "url": "https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf",
          "external_id": "cit:d23bc120-522d-45cb-9bf7-21f37a227785",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94da8c615045093b4af34b2f37ae8dc0db25c7f1b60d46db4cfaaa3cf0a113e6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "DreamHost disclosed exploitation of its web-based File Manager that exposed FTP/SFTP login credentials used from approximately August through October 23, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7dbbca12-95d5-515d-8d80-e02204923421",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:022dce15-479f-4f4c-889e-9dba785b33eb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "DreamHost",
          "url": "https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf",
          "external_id": "cit:69a0f9e4-6e8d-49d6-a958-13331a701047",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94da8c615045093b4af34b2f37ae8dc0db25c7f1b60d46db4cfaaa3cf0a113e6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "DreamHost stopped access, addressed the vulnerability, terminated affected sessions and reset passwords. It engaged outside forensic specialists and offered a year of identity protection."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e143bcb3-c305-57c7-8efc-23f75aa12b1e",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:2478abc6-7696-4b07-80c4-5307c8fea2ad",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "DreamHost",
          "url": "https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf",
          "external_id": "cit:a4cbecd5-0ecb-4038-9ac7-4e9d8ee4f6c0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94da8c615045093b4af34b2f37ae8dc0db25c7f1b60d46db4cfaaa3cf0a113e6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "DreamHost identified a vulnerability in the File Manager software but did not name a CVE or establish the attacker’s identity."
      }
    }
  ]
}