DreamHost Resets Some Email and FTP/SFTP Passwords as a Precaution During Ongoing Incident (October 2026)

DreamHost, the US web hosting provider and domain registrar, has expired the passwords of some email, FTP and SFTP user accounts as a precaution during an incident that began on 23 October 2026. The incident first showed up as connectivity problems with the web-based File Manager (files.dreamhost.com), then affected webmail sign-ins. According to DreamHost's status page, the File Manager came back online on 26 October and DreamHost is monitoring it. Password resets are still required for the affected accounts.

DreamHost has not disclosed a cause, how many accounts are affected, or whether any email or files were accessed. It calls the resets a precaution "to ensure the continued integrity of DreamHost customer accounts". In its customer notice, DreamHost asks account owners to set new passwords from the panel and to check each email address for forwarding settings they do not recognise. Mail continues to be delivered to affected mailboxes, and FTP/SFTP data remains stored on the server.

For organisations that use DreamHost, or whose suppliers do, the practical steps are simple: set new passwords from the panel, remove unknown forwards, update stored credentials in mail clients and deployment tools, and be wary of password-reset emails. No CVE is involved, so there is nothing to look up in CISA's Known Exploited Vulnerabilities catalog.

Technical Information

What DreamHost has said

From DreamHost's status page incident ("Investigating an incident affecting File Manager and Webmail", 23–26 October 2026) and its Current Status Notifications article (25 October 2026, last updated 26 October):

• Services affected. The panel File Manager went offline and "some webmail users have been signed out or may see an error when logging in." DreamHost later described "an issue affecting some of our systems, including FTP/SFTP access and webmail."
• Precautionary password resets. DreamHost says "passwords of some mail, FTP, and SFTP user accounts were recently expired." Affected users cannot sign in until the DreamHost account owner sets a new password and shares it with them.
• What keeps working. "Mail accounts will continue to receive mail, and FTP and SFTP user data remains stored on the server."
• Forwarding rules. DreamHost asks account owners to "review the forwarding settings on each address and remove any forward that you don't recognize or may no longer use." DreamHost has not said why it gives this advice or whether any forwarding rules were changed.
• Notification. By 25 October, DreamHost said all affected account holders had been emailed step-by-step instructions. It says it "will never email you asking for your password," and that its notification will not ask you to log in through a link.
• File Manager. On 26 October DreamHost said a fix had been pushed and files.dreamhost.com was back online, with the incident in monitoring.

DreamHost has not linked the incident to any vulnerability or named an attacker. BleepingComputer reported on 26 October that it had asked DreamHost about the incident, the number of affected accounts and whether files or messages were exposed, and had not received a reply.

Timeline

Times are as DreamHost posted them (Pacific Daylight Time), with UTC in brackets.

What is not known

• What caused the incident. DreamHost has not said.
• How many accounts are affected. DreamHost says "some" users; it has not given a number.
• Whether any email or files were accessed. DreamHost has not said. A precautionary reset does not by itself mean an account was compromised.
• Why forwarding rules should be checked. DreamHost gives the advice without explaining it.

Affected Product Versions

This is a service incident at a hosting provider, not a flaw in software that customers run. There is no CVE, affected version or patch.

Workaround and Mitigation

DreamHost's own steps, from its customer notice:

• Sign in to the panel directly at panel.dreamhost.com, not through a link in an email.
• Email users: under Mail > Manage Email, set a new password for each address (DreamHost instructions), and remove any forward you do not recognise or no longer use.
• FTP/SFTP users: under Websites > SFTP Users & Files, set a new password for each user. A new password can take up to 15 minutes to take effect.
• Update stored passwords in every email, FTP and SFTP client that saves them.
• Tell your users by phone, secure text or another private channel, not their DreamHost-hosted email, which they cannot open until they have the new password.

The steps below are Rescana guidance for DreamHost customers and for teams whose suppliers host email or websites there:

• Update automated credentials too. Deployment scripts, CI jobs, backup tools and website plugins that sign in over FTP/SFTP will stop working until they get the new password.
• Use strong, unique passwords, as DreamHost advises, and change the old password anywhere else it was reused. BleepingComputer also reports that users are advised to change reused passwords.
• Treat password-reset emails with care. Ignore reset emails you did not request, and never enter a password through an emailed link.
• Check for routine signs of misuse if you are an account owner: unfamiliar forwards or mail filters, unexpected SFTP users, and recent file changes on your sites. This is good practice, not a sign that your account was affected.
• Ask suppliers that use DreamHost whether they were affected and have finished their resets, especially if they send you invoices or files from DreamHost-hosted email.

Indicators of Compromise

DreamHost and the reporting cited here have not published any indicators of compromise, and a web search on 27 October 2026 found no national CERT notice with any.

What we will update

We will update this post if DreamHost closes the incident or states a cause; if DreamHost confirms how many accounts were affected or whether any email or files were accessed; or if a national CERT or regulator publishes a notice.

Sources

• DreamHost Status, Investigating an incident affecting File Manager and Webmail (23–26 October 2026)
• DreamHost Knowledge Base, Current Status Notifications: Password Resets Required (25 October 2026, last updated 26 October 2026)
• DreamHost Knowledge Base, Change password: Mail users
• BleepingComputer, DreamHost forces password resets in ongoing "incident" (26 October 2026)

Checked, nothing found (27 October 2026): a web search found no CISA, CERT-EU or UK NCSC notice naming DreamHost; CISA KEV not applicable (no CVE involved).

Why this matters for third-party risk

Small suppliers often run their email and websites on shared hosting, so a precautionary reset at the host can quietly break their mail, their file transfers and their deployments, and leave them open to reset-themed phishing. A good vendor review knows which suppliers depend on which hosting providers, and asks them how quickly they act on a host's security notices.

Forward this to your TPRM owner: DreamHost expired some email and FTP/SFTP passwords as a precaution during an incident that began 23 October. No cause, count or data exposure has been disclosed. Owners should reset from the panel, remove unknown mail forwards and update stored credentials. Ask suppliers that use DreamHost whether they were affected (Rescana guidance).

Want to see which of your suppliers depend on shared hosting providers like this, and how they respond to an incident? Book a demo.