SockAnalyst
← All playbooks
HighBreach · 2026-11-06

DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen

What happened

DreamHost disclosed that on the afternoon of Friday, October 23, 2026 it discovered unauthorized access to the server running its web-based File Manager at files.dreamhost.com. Attackers exploited a vulnerability in the third-party File Manager software and obtained FTP/SFTP usernames and passwords for customers who logged into File Manager between approximately August 2026 and October 23, 2026. They also reached certain webmail systems and obtained login credentials for a limited number of webmail users; in a small number of cases DreamHost believes mailbox contents may have been viewed. DreamHost took File Manager offline, patched the vulnerability, reset affected email and FTP/SFTP passwords, ended active sessions, rebuilt File Manager with extra monitoring, and notified regulators. It says it has found no evidence that control-panel logins or billing/payment details were accessed. Current analysis puts affected email and FTP/SFTP accounts well under about 10% of those hosted at DreamHost. Formal breach notices and identity-protection offers (Equifax) followed in early November.

Who's affected

DreamHost customers (or FTP/SFTP users on their accounts) who used File Manager roughly August–October 23, 2026, plus a limited set of webmail users. Hosting customers who reuse those passwords elsewhere, and any site whose files or mail filters may have been altered during the window.

✅ Fix / patch

  • DreamHost account holders: reset mail and FTP/SFTP passwords from panel.dreamhost.com (only the account holder can set new ones; changes can take up to ~15 minutes). Update saved passwords in email/FTP clients.
  • Review website files for unrecognized changes; check webmail forwarding rules and filters for anything you did not set; rotate any reused passwords on other services.
  • Treat DreamHost password-reset or File Manager emails that ask you to sign in via a link as phishing—DreamHost says it will not email asking for your password, and account passwords are only changed inside the control panel.
  • If you store customer/client data on DreamHost, assess your own notification obligations; DreamHost is offering Equifax credit monitoring/identity protection to notice recipients.

🔎 Quick hunt check

No public attacker IPs, malware or CVE from DreamHost. Inventory hosts and CMS sites still using DreamHost FTP/SFTP; alert on new or changed authorized_keys/web shells, unexpected file writes under document roots since August 2026, and new mailbox forwarding/filter rules. Watch for phishing that spoofs DreamHost password resets or File Manager.

MITRE ATT&CK: T1078, T1190, T1213, T1110, T1566

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=* (sourcetype=*ftp* OR sourcetype=*webmail* OR sourcetype=*linux_secure* OR index=email)
(user="*dreamhost*" OR dest_host="*dreamhost*" OR url="*files.dreamhost.com*" OR subject="*DreamHost*" OR subject="*File Manager*")
| stats count min(_time) as first max(_time) as last values(src) as src values(action) as action by user, dest, sourcetype
union isfuzzy=true
 (SigninLogs | where AppDisplayName has_any ("DreamHost","FTP","SFTP","webmail") or IPAddress != ""),
 (EmailEvents | where Subject has_any ("DreamHost","File Manager","password reset") and SenderFromDomain !endswith "dreamhost.com")
| where TimeGenerated >= ago(90d)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserPrincipalName=coalesce(UserPrincipalName, RecipientEmailAddress), AppDisplayName, IPAddress=coalesce(IPAddress, tostring(SenderIPv4)), Subject
// Triage: unexpected FTP/webmail auth and DreamHost-themed phishing outside dreamhost.com

⏱ CISA deadline

Not in CISA KEV as of Nov 6, 2026.

Sources

Related playbooks