Identity
DreamHost resets email and FTP passwords, no cause given
DreamHost took File Manager offline and reset some email and SFTP passwords after an unexplained incident. What owners must do now, and what is unknown.
On Thursday October 23, DreamHost took its browser-based File Manager at files.dreamhost.com offline, signed some webmail users out, and began resetting passwords for some email and FTP/SFTP users "as a precaution". The File Manager came back on October 26 and DreamHost marked the incident resolved on October 27, but its status page still says a subset of email and FTP/SFTP accounts need new passwords. Those users cannot log in until the account owner sets one.
DreamHost has not said what happened, how many accounts were reset, or whether any passwords were exposed. SecurityWeek asked about the root cause and the number of affected users and had no answer at publication. If you run sites or mail on DreamHost, for yourself or for clients, act this week whatever the cause turns out to be. One step has a deadline: DreamHost keeps web access logs for only seven days.
What DreamHost has confirmed
The status page is the only first-hand record. Two details in it matter for owners. The first notice said only email passwords were being reset; by 10:13 PM Pacific on October 23 the scope had grown to FTP/SFTP users, with DreamHost describing an issue "affecting FTP/SFTP access and webmail". And early updates told users to wait for an email because changes made before the reset finished would be overwritten, so a password set before 10:37 AM on October 24 may not have stuck. Check it. On October 25 DreamHost also fixed a "Failed to edit" error that blocked some Professional Email customers from setting passwords, so anyone who gave up after that error should try again.
Account owners heard more than individual users. DreamHost says it cannot contact mailbox or FTP users directly, so the owner has to tell them. A copy of the owner notice was posted on Reddit, and webhosting.today and CyberInsider report its contents: set new passwords for affected users, review forwarding settings on every mailbox and remove any destination you do not recognise, and change the old password anywhere else it was reused. SecurityWeek also reports the reuse advice. According to webhosting.today, the notice's subject line asks owners to update passwords for all users on the account, not only those that were reset. The notice also says locked mailboxes keep receiving mail and SFTP users' files stay on the server.
What is not known
DreamHost has not published a root cause. It has not said whether the File Manager fault and the password resets share a cause, whether any credential was read or used by someone outside DreamHost, how passwords are stored, or how many of its customers were affected. SecurityWeek describes users complaining about the lack of transparency and speculating about a compromise and about how passwords were hashed; none of that is confirmed.
That gap changes what a cautious owner should assume. DreamHost chose to expire credentials rather than only fix a service, and asked owners to look for unfamiliar forwarding, which is the check you run when someone else may have had a mailbox. Until DreamHost says more, treat the reset accounts as possibly exposed and check them.
Why these two credential types matter
An SFTP (SSH File Transfer Protocol) login on shared hosting is write access to the website's files. Anyone holding one can upload a web shell, a script that runs commands on the server when requested over HTTP, or add a few lines to a WordPress theme to inject spam or redirect visitors. Changing the password later does not remove a file planted with the old one.
A mailbox password gives an attacker the inbox and a way to stay in it. A forwarding rule copies every new message to an outside address and keeps working after the password changes, which is why DreamHost asks owners to check them. The same mailbox usually receives the password reset links for the domain registrar, the payment processor and the site's admin login, so a forwarded copy can be used to take those over too. DreamHost's help center notes that its email service does not support multifactor authentication (MFA), so the password is the only barrier.
What to do
1. Set new passwords, for every user
Type panel.dreamhost.com into the browser yourself. Set new passwords for mailboxes under Mail > Manage Email and for FTP/SFTP users under Websites > SFTP Users & Files. Do it for every user on the account, including those DreamHost did not reset, and use a fresh random password for each. Send the new password to each user by phone or another channel, not to the mailbox you are resetting. Allow up to 15 minutes before testing, then update mail apps on phones and laptops. Anyone who used the old password elsewhere, such as a WordPress admin login or the registrar, should change it there too.
2. Check mail settings
For each address under Mail > Manage Email, open the forwarding settings and remove any destination you did not set up. Ask users whether they see filters or rules in webmail or their mail app that they did not create. Look in Sent Items for messages users did not write, and in the inbox and Deleted Items for password reset emails from other services they did not request since October 23.
3. Save logs and look at the site files
Copy the web logs today. DreamHost rotates them daily and keeps them for seven days by default, so entries from October 23 will be gone around October 30. They live in ~/logs/example.com/https/ (or http/), reachable over SFTP or SSH. Search the access log for POST requests to PHP files that are not part of your application.
Then compare the site with a known-good copy. Over SSH, find ~/example.com -type f -newermt 2026-10-20 -ls lists files changed since October 20. Look closely at new .php files under wp-content/uploads, edited .htaccess files, and new WordPress administrator accounts. If you find planted files, restore from a backup taken before October 23 rather than deleting files one by one.
DreamHost has not said whether it can supply SFTP or webmail login records for affected users. If you need them for a client, ask support through the panel and keep the reply.
4. Expect phishing that copies the notice
The owner notice is circulating, which makes a fake "reset your DreamHost password" email easy to write. Every status update says DreamHost will not ask for passwords by email or send login links, and that unrequested reset emails should be ignored. Tell clients and staff to treat any such message as phishing.
5. Harden for next time
Turn on MFA for the panel login on the Security page, using an authenticator app or a YubiKey, and do the same for every privileged panel user. Give each developer or agency their own SFTP user instead of sharing one, so you can revoke one person without resetting everyone. Where a user has shell access, switch to SSH key login, which DreamHost documents in its passwordless login guide, so a leaked password alone does not open the files.
Agencies that hold hosting accounts for clients carry the extra job here, because the notice reached only the account holder. Keep a list of which client contact sits behind each mailbox and SFTP user, and a current backup of each site, before the next notice arrives.
If you want help checking a site for planted files or tightening how your hosting, mail and panel logins are set up, see our safeguarding and hardening and security operations services. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: DreamHost status page incident, SecurityWeek, webhosting.today, CyberInsider, Reddit r/webhosting thread, DreamHost: viewing your access log, DreamHost: Multifactor Authentication overview, DreamHost: passwordless SSH login.