DreamHost Mandates Password Resets After Unexplained Security Incident
Web hosting provider DreamHost has forced mandatory password resets for email and FTP/SFTP accounts following a security incident that disrupted access to its webmail and File Manager services.
DreamHost has implemented mandatory password resets for its email and FTP/SFTP accounts after an unspecified security incident disrupted access to its webmail and File Manager services. The incident, which began on October 23, 2026, initially caused connectivity issues with the File Manager. Subsequently, webmail services were also affected, leading the company to expand the precautionary password resets to FTP/SFTP users.
Engineers successfully restored File Manager connectivity on October 26, but the requirement for users to reset their passwords remained in place. DreamHost had initially advised customers to await further instructions, as password changes made before the company's reset process concluded could be overwritten. However, by October 24, the company confirmed that affected account owners could proceed with setting new passwords directly through the control panel.
DreamHost stated that all impacted account holders received instructions for resetting their passwords by October 25. The company also addressed a specific error that prevented some Professional Email customers from changing their passwords. Despite the login disruptions, DreamHost assured users that affected mailboxes continued to receive messages and that FTP/SFTP data remained stored on its servers, distinguishing the access issue from potential data loss.
Users are instructed to navigate to panel.dreamhost.com and utilize the 'Mail > Manage Email' section for mailbox passwords or 'Websites > SFTP Users & Files' for file access credentials. DreamHost noted that password changes might take up to 15 minutes to propagate. Crucially, users must also update saved passwords within their email applications and FTP/SFTP clients to reflect the new credentials.
Furthermore, DreamHost is advising customers to review their mailbox forwarding settings for any unfamiliar or unauthorized entries. While the company has not confirmed any data theft or identified a specific attacker, the recommendation to check forwarding rules echoes concerns seen in previous incidents where attackers manipulated such settings to hide malicious activity.
Unlike some other high-profile breaches, DreamHost has not disclosed the cause of the incident, the specific entry point exploited, or confirmed whether any unauthorized access to data occurred. The precautionary password resets are the primary action taken thus far. The company is emphasizing security best practices by reminding customers that it will never request passwords via email and urging them to access the control panel directly rather than clicking links in notifications.
The core questions surrounding the incident's origin, its full scope, and the extent of any potential unauthorized access remain unanswered. DreamHost's transparency regarding the cause and impact will be critical as the situation develops.
The incident, which began on October 23, initially affected DreamHost's File Manager, leading to its temporary offline status. While the File Manager has since been restored, the disruption extended to email and FTP/SFTP services, necessitating mandatory password resets for a subset of affected customers. The company has been criticized by some users for its communication regarding the incident and the lack of immediate explanation for the password resets.