DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident

DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set.

DreamHost said the password resets were precautionary but has not disclosed the cause or confirmed data theft. The incident began on October 23, 2026, with File Manager connectivity issues.

Later updates reported webmail errors and expanded the password resets to FTP/SFTP users. By October 26 at 3:35 p.m. PDT, engineers had restored the File Manager. They monitored the fix, but password changes remained required.

DreamHost initially told customers to wait for instructions because password changes made before its reset process finished would be overwritten. On October 24, it confirmed that affected account owners could set new passwords directly through the control panel without waiting for an email.

By October 25 at 9:32 p.m. PDT, DreamHost said all impacted account holders had received instructions. It also fixed a “Failed to edit” error that had prevented some Professional Email customers from changing their passwords.

DreamHost Forces Email and FTP Password Resets

The company’s current status notice says affected mailboxes continue receiving messages even when users cannot access them. FTP and SFTP data also remains stored on its servers. This separates the login disruption from any claim of deleted files or lost incoming email.

Account owners should open panel.dreamhost.com directly and use “Mail > Manage Email” for mailbox passwords or “Websites > SFTP Users & Files” for file access credentials. DreamHost says changes can take up to 15 minutes. Saved passwords in email applications and FTP/SFTP clients must also be updated.

DreamHost also advises checking mailbox forwarding settings and removing unfamiliar or unused entries. New credentials should reach affected users by phone call, secure text, or another private channel rather than through their inaccessible DreamHost mailbox.

The forwarding check deserves attention. Previous reporting on hidden mailbox rules in Microsoft 365 shows how attackers can redirect messages and hide security warnings. DreamHost’s recommendation, however, does not establish that attackers changed forwarding settings during this incident.

Unlike the confirmed GoDaddy hosting breach, the available DreamHost notices do not identify an attacker, malware, an entry point, or a confirmed data theft. Password resets alone do not establish those details.

DreamHost says it will never request passwords by email. Its incident updates instruct customers to visit the control panel directly rather than follow login links in notifications. For now, the key unresolved questions remain the incident’s cause, its scope, and whether any unauthorized access occurred.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident appeared first on Cyber Security News.