Web host DreamHost has forced password resets for email and FTP/SFTP users after an incident that it first reported on October 23 as connectivity problems with its File Manager. According to BleepingComputer, the impact then spread to other services, and the company blocked access for all those users until their passwords were reset, which it described as a precaution. DreamHost’s status page says every affected account holder has now been emailed step-by-step reset instructions, and that mail and FTP/SFTP users cannot log in until the account owner sets and shares new credentials. As of BleepingComputer’s report on Monday, the incident was still marked active and File Manager was still unavailable.
DreamHost has not said what happened, how many accounts were affected, or whether files or messages were exposed; BleepingComputer says its questions went unanswered. The company’s notices do tell account owners to look for email forwarding rules they do not recognise and remove them, which BleepingComputer reads as a sign that some mailboxes may have been accessed by outsiders. That is an inference by the outlet, not something DreamHost has confirmed. Customers quoted in the report complained about the lack of explanation.
How to check if you’re affected
Affected products are DreamHost email (including Professional Email), webmail, and FTP/SFTP users on DreamHost accounts. Based on DreamHost’s status page and BleepingComputer’s report:
- If you own a DreamHost account, you do not need to wait for the email: DreamHost says you can set new passwords now at panel.dreamhost.com under “Mail > Manage Email” or “Websites > SFTP Users & Files”, and that a new password can take up to 15 minutes to take effect.
- If you only use a DreamHost mailbox or FTP/SFTP login, ask the account owner to set a new password and share it with you. DreamHost says it cannot contact individual mailbox or FTP users directly.
- Open each email address in the panel and check for forwarding rules; remove any destination you do not recognise.
- If you reused your old DreamHost password anywhere else, change it there too.
- DreamHost says it will never email you asking for your password, and tells customers to go directly to panel.dreamhost.com to make changes.