DreamHost forces password resets after unexplained security incident

Key Takeaways

• DreamHost initiated mandatory password resets for numerous email and FTP/SFTP accounts following an undisclosed security incident.
• The incident, which began on October 23, 2026, disrupted webmail and File Manager access, preventing users from logging in.
• While the company assures that the resets are precautionary, the exact cause of the incident and whether data theft occurred have not been disclosed.
• Affected users must update their passwords directly through the DreamHost control panel and check for any unauthorized email forwarding rules.

DreamHost has mandated password resets for a segment of its email and FTP/SFTP account holders after an unexplained security event rendered webmail and File Manager inaccessible. Users were unable to log in until new credentials were established.

The hosting provider characterized these password resets as a precautionary measure, but has refrained from revealing the underlying cause of the incident or confirming any data compromise. The disruption commenced on October 23, 2026, with initial reports indicating issues with File Manager connectivity.

Subsequent updates from DreamHost detailed webmail errors and extended the requirement for password resets to include FTP/SFTP users. By October 26 at 3:35 p.m. PDT, DreamHost engineers had successfully restored File Manager functionality and were monitoring the fix, though the mandatory password changes remained in effect.

Initially, DreamHost advised customers to await specific instructions, warning that any password changes made before the completion of its internal reset process would be overwritten. However, on October 24, the company clarified that affected account owners could directly set new passwords via the control panel, bypassing the need to wait for an email notification.

By October 25 at 9:32 p.m. PDT, DreamHost confirmed that all impacted account holders had received the necessary instructions. The company also resolved a “Failed to edit” error that had been preventing some Professional Email customers from successfully changing their passwords.

DreamHost Forces Email and FTP Password Resets

The company’s current status notice says that despite the login disruption, affected mailboxes continue to receive messages, and FTP and SFTP data remains securely stored on its servers. This distinction indicates that the incident primarily impacted login access rather than leading to file deletion or loss of incoming email.

Account holders are instructed to navigate directly to panel.dreamhost.com. For mailbox password changes, users should go to “Mail > Manage Email,” and for file access credentials, they should use “Websites > SFTP Users & Files.” DreamHost notes that these changes might take up to 15 minutes to propagate. It is also crucial for users to update any saved passwords in their email applications and FTP/SFTP clients.

DreamHost further recommends that users review their mailbox forwarding settings and promptly remove any unfamiliar or inactive entries. New credentials should ideally be communicated to affected users via phone, secure text message, or another private channel, rather than through their potentially inaccessible DreamHost mailbox.

The emphasis on checking forwarding settings is noteworthy. Past incidents, such as those involving hidden mailbox rules in Microsoft 365, have demonstrated how attackers can reroute messages and conceal critical security alerts. However, DreamHost’s recommendation in this context does not explicitly confirm that attackers modified forwarding settings during this particular incident.

Unlike the well-documented GoDaddy hosting breach, DreamHost’s public notices have not identified any specific attacker, malware, entry point, or confirmed instance of data theft. The mere requirement for password resets does not, by itself, provide these specific details.

DreamHost explicitly states that it will never request passwords via email. Its incident updates consistently advise customers to visit the control panel directly rather than clicking on login links in any notifications. At present, the primary unresolved questions revolve around the precise cause of the incident, its full scope, and whether any unauthorized access to user accounts or data actually occurred.

What You Should Do

• Immediately change your DreamHost passwords for all affected email and FTP/SFTP accounts via the official control panel (panel.dreamhost.com).
• Do not click on password reset links in emails; always navigate directly to the DreamHost control panel.
• Review all email forwarding settings within your DreamHost accounts and delete any unfamiliar or unused rules.
• Update saved passwords in all email clients, FTP clients, and other applications that access your DreamHost services.
• Consider enabling multi-factor authentication (MFA) on your DreamHost account if available, and for all other critical online services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.