DreamHost resets email and FTP passwords after an incident

DreamHost, a US web hosting provider and domain registrar, has reset the passwords of some of its customers’ email mailboxes and FTP/SFTP accounts after an incident that began on 23 October 2026. The company calls it a precaution but has not explained the cause or how many accounts are involved: BleepingComputer and SecurityWeek say they asked and received no answer. According to the company’s own figures quoted by BleepingComputer, DreamHost serves more than 400,000 customers in over 100 countries.

Timeline

The reconstruction is based on DreamHost updates reported by Help Net Security, BleepingComputer and SecurityWeek:

• 23 October, afternoon: the operations team reports connectivity problems with the File Manager, the web interface for managing site files. A few hours later the incident spans several services: the File Manager (files.dreamhost.com) is taken offline and some webmail users are signed out or get errors when logging in.
• 23 October, evening: DreamHost says the issue also involves FTP/SFTP access and starts resetting passwords “for some email and FTP/SFTP users”. It asks customers not to change passwords themselves before receiving instructions, because any change made during the reset would be overwritten.
• 24 October: according to Help Net Security, the resets are completed.
• 24–25 October: recovery instructions go out in batches to account owners; on the evening of the 25th DreamHost says it has sent them to everyone affected.
• 26 October: according to SecurityWeek and Help Net Security, DreamHost has deployed a fix and restored files.dreamhost.com, which remains under observation. BleepingComputer, in its article the same day, still reported the File Manager as unavailable. According to Help Net Security, the status page still lists email hosting, webmail and the File Manager as disrupted.

What is known and what is not

No CVE, affected software or cause has been disclosed. The technical details available come from the notices sent to account owners:

• Who stays locked out: users of the affected mailboxes and FTP/SFTP accounts cannot sign in until the DreamHost account owner sets new credentials. DreamHost says it cannot contact individual users directly and asks owners to reach them by phone, text or other channels: anyone whose mailbox is locked does not receive email.
• Forwarding rules: according to BleepingComputer, DreamHost asks owners to review every mailbox for automatic forwarding and remove any unknown destination. The outlet notes that this suggests some mailboxes may have been breached; DreamHost has not confirmed it. A hidden forwarding rule lets an attacker keep reading mail even after a password change (MITRE ATT&CK T1114.003, Email Forwarding Rule).
• Reused passwords: DreamHost asks users to change the old password wherever else it was used (BleepingComputer and SecurityWeek). Reuse would turn any credential theft into access with valid accounts elsewhere (T1078).
• Phishing: in every update DreamHost reminds customers that it never asks for passwords by email and that unrequested reset emails can be ignored (Help Net Security, SecurityWeek). A mass reset is a convenient pretext for fake emails.

On Reddit some customers wonder whether passwords were stored with adequate hashing (SecurityWeek) or whether there is a link to the recent PHP vulnerabilities; according to a customer quoted by Help Net Security, the support chatbot ruled out that connection. None of these hypotheses has been confirmed.

Impact for European and Italian companies

Shared hosting with bundled email is common among small businesses, professional firms and web agencies that run sites and mailboxes on behalf of their clients. The concrete risks:

• email downtime until the account owner hands out new passwords: for an agency with dozens of client mailboxes, the recovery work falls entirely on it;
• hidden forwarding in mailboxes that may have been breached: the classic basis for payment fraud (BEC) and theft of correspondence;
• site files reachable over FTP/SFTP: no source mentions changes, but anyone holding valid credentials can upload files;
• GDPR and NIS2: an organisation using hosted business mailboxes remains the data controller. If checks reveal unauthorised access to messages containing personal data, notification to the supervisory authority within 72 hours must be assessed (Article 33). For NIS2 entities (in Italy, Legislative Decree 138/2024) the episode falls under supplier risk management: the timing and level of detail of the information received should be documented too.

What to do now

If you use DreamHost, including indirectly through an agency:

1. Check the notices in the control panel and in the account owner’s mailbox, spam folder included: some customers report receiving them very late.
2. Set new passwords for every mailbox and FTP/SFTP account listed, long and unique, and deliver them to users over a separate channel, not by email.
3. Review forwarding and rules on every mailbox: forwarding to unknown external addresses, filters that move or delete messages, altered auto-replies.
4. Change reused passwords elsewhere, starting with admin credentials for sites, CMSs and cloud services.
5. Check the site files: compare files modified since 23 October with the last trusted backup and look for unexpected PHP scripts, especially in folders where files can be uploaded.
6. Review the available logs for webmail and FTP/SFTP, looking for logins from unusual addresses or countries during the incident.
7. Warn users about phishing: no legitimate email asks you to enter your old password.
8. Document everything (dates, notices, checks) for the GDPR and, where relevant, NIS2 assessment, and ask DreamHost in writing for the cause and the data involved.

How ARXDOME helps

ARX Expose flags company accounts involved in known breaches and checks the email configuration of your domains (SPF and DMARC): it helps you notice early if business credentials start circulating. ARX Horizon enriches events from monitored systems with country, network operator and threat lists, so logins from suspicious sources stand out immediately.

Last updated: 27 October 2026