Security Guides

#web hosting #email security #password #account security #incident response #phishing

DreamHost incident (October 2026): passwords of some email, FTP and SFTP users reset, and what account owners should do

DreamHost reset the passwords of some email, FTP and SFTP users from October 23, 2026 and took File Manager offline. What is known, and steps for owners.

Published 2026-10-31 Updated 2026-10-31 Last verified 2026-10-31 9 min read

On this page

For: website and email owners who host with DreamHost, and people who use a mailbox or SFTP login on a DreamHost account. This article is based on DreamHost's status page and help article, and does not cover attack techniques.

Developing: this article will be updated as the organisation publishes more

Who is affected: website and email owners who host with DreamHost, and people who use a mailbox or SFTP login on a DreamHost account.
Confirmed so farSee the table ↓: Passwords of some email, FTP and SFTP users reset
File Manager offline, then restored
Mail delivery and stored files during the lockout
1 more
Affected owners notified
Not yet confirmed: What caused the incident
How many customers and accounts are affected
Whether any mail, files or passwords were accessed
1 more
Why owners are asked to check email forwarding
What to do nowSee the steps ↓: Open the DreamHost panel yourself
Set a new password for every email address
Remove email forwards you do not recognise
3 more
Set a new password for every FTP and SFTP user
Tell your users through a channel other than their DreamHost mailbox
Change the same password anywhere else you used it
Where to verify (source)All sources ↓: DreamHost Status, "Investigating an incident affecting File Manager and Webmail" (October 23–27, 2026)
Last checked: As of October 31, 2026 (JST)

Follow-up plans and what we checked

DreamHost marked its status post resolved on October 27 and said it would post updates on its status page. As of October 31, neither the status page nor its help article gave a cause, a count or a statement on data access.

What DreamHost account owners should do today

Open the DreamHost panel yourself

Type panel.dreamhost.com into the browser or use your own bookmark. DreamHost says it will never email you asking for your password and that its notification will not ask you to log in through a link (see What is phishing?).

If you have not done so already, turn on multi-factor authentication for the panel login.

Set a new password for every email address

In the panel, go to Mail > Manage Email and set a new password for each address on the account, as DreamHost's help article says. Use a different, strong password for each one. DreamHost says a new password can take up to 15 minutes to take effect.

Remove email forwards you do not recognise

While you are on the Manage Email page, DreamHost asks you to review the forwarding settings on each address and remove any forward you do not recognise or no longer use. Do this for every address, including ones nobody reads often.

Set a new password for every FTP and SFTP user

Go to Websites > SFTP Users & Files and set a new password for each user. Then update the password wherever it is saved: FTP clients, deployment scripts, CI jobs and backup tools (DreamHost says any client that stores the password needs updating).

As a precaution (our suggestion), look at recently changed files in your website folders and any administrator accounts in your web apps for anything you did not add.

Tell your users through a channel other than their DreamHost mailbox

According to security news reports, DreamHost told account owners it cannot contact individual mailbox or FTP users directly. Its help article asks owners to reach staff, clients or family members by phone, secure text or another private channel, because they cannot read their inbox until they get the new password. Remind them to update the password in their mail apps and phones.

Change the same password anywhere else you used it

According to security news reports, DreamHost's notice to account owners advises changing the password on other services if the old DreamHost password was reused there. Check your password manager or check whether a password has leaked.

If you only use a mailbox or SFTP login

You cannot reset it yourself. DreamHost says email and FTP users should contact the account owner, who sets the new password. Any message that asks you to reset or confirm your DreamHost password through a link should be treated as suspicious.

What happened (from DreamHost's status page)

Times are US Pacific time (PDT), as DreamHost gives them. Japan time is 16 hours ahead.

October 23, 2:20 PM
DreamHost starts investigating connectivity issues affecting the File Manager interface.
October 23, 5:20 PM
It is investigating an incident affecting several services. File Manager (files.dreamhost.com) is offline, and some webmail users have been signed out. As a precaution, it is resetting the passwords of some email accounts.
October 23, 10:13 PM
The issue affects some systems, including FTP/SFTP access and webmail. DreamHost is resetting passwords for some email and FTP/SFTP users, and asks people to wait for its email because earlier changes would be overwritten.
October 24, 10:37 AM
The reset is complete. Account owners can set new passwords in the panel without waiting for the email.
October 25
All affected account holders have been emailed step-by-step instructions (9:32 PM post). The help article "Password Resets Required" is published, dated October 25.
October 26, 3:35 PM
A fix is pushed and File Manager is back online.
October 27, 4:45 PM
The status post is marked resolved. Password resets are still required for a subset of email and FTP/SFTP accounts.

What DreamHost has published

Organisation: DreamHost (web hosting and email hosting)
Services affected: File Manager (files.dreamhost.com), webmail, FTP/SFTP access
Action taken: Passwords of some mail, FTP and SFTP user accounts expired "as a precaution"; owners must set new ones
During the lockout: Mail accounts keep receiving mail; FTP and SFTP user data stays on the server (help article)
Owner request: Review forwarding on each email address and remove unrecognised forwards
Notification: Emails with instructions to affected account owners (October 24–25)
Status: Resolved on October 27; resets still required for a subset of accounts
Cause, count, data access: Not stated

What is known and what is not

Status as of October 31, 2026. We will update this table if DreamHost publishes more.

Item	What DreamHost said	Status
Passwords of some email, FTP and SFTP users reset	Expired as a precaution; owners must set new ones	Confirmed (DreamHost)
File Manager offline, then restored	Offline from October 23, back online October 26	Confirmed (DreamHost)
Mail delivery and stored files during the lockout	Mail is still received; FTP/SFTP data remains on the server	Confirmed (DreamHost)
Affected owners notified	Emails with instructions sent by October 25	Confirmed (DreamHost)
Review of email forwarding	Owners asked to remove unrecognised forwards; no reason given	Not stated
Cause of the incident	Not published	Not stated
Number of customers or accounts affected	Not published	Not stated
Whether mail, files or passwords were accessed	Not published	Not stated

Oct 23

File Manager taken offline (US Pacific time)

Some

Email, FTP and SFTP users whose passwords were reset

Oct 27

Status post marked resolved; resets still needed

Not stated

Cause, number affected, data access

What a forced reset like this means for a mailbox

DreamHost does not say whether anyone else got into an account. The points below are general, not a statement about this incident.

Email forwards

Panel: Mail > Manage Email

Saved passwords in apps and tools

Mail apps, phones, FTP clients, CI

Reused passwords elsewhere

Change them, turn on MFA

Settings that survive a password change, and where to check them

A forward keeps copying new mail to another address after the password changes. That is why removing unknown forwards matters as much as the new password.
A mailbox is where password reset links for other services arrive. If you use a DreamHost-hosted address to sign in elsewhere, those accounts depend on it.
During a well-publicised reset, fake "reset your password" emails are common. The safe habit is the one DreamHost gives: go to the panel yourself.

For people who run sites on shared hosting

When the provider resets credentials for you, the work that stays with you is knowing where those credentials are used. Keep a list of every mailbox, SFTP user and the tools that store their passwords, so a reset like this takes minutes rather than a day. For a wider checklist on provider-side incidents, see what to do when your hosting provider is breached, and for an earlier case where a provider confirmed access to customers' web space, see ConoHa WING unauthorized access (a separate incident).

Sources

Checked on October 31, 2026 (JST).

DreamHost Status, "Investigating an incident affecting File Manager and Webmail" (October 23–27, 2026) — dreamhoststatus.com
DreamHost Knowledge Base, "Current Status Notifications" (October 25, 2026: Password Resets Required; last updated October 26) — help.dreamhost.com
Security news report (October 26, 2026) — bleepingcomputer.com
Security news report (October 27, 2026) — securityweek.com

Update history

2026-10-31: First version, based on DreamHost's status page (October 23–27) and help article (October 25).

Latest breaking reports

All breaking reports →

FAQ

QWhat happened at DreamHost?

According to DreamHost's status page, on October 23, 2026 (US Pacific time) it began investigating an incident affecting several services. File Manager was taken offline, some webmail users were signed out, and as a precaution DreamHost reset the passwords of some email, FTP and SFTP users. File Manager was restored on October 26 and the status post was marked resolved on October 27, but password resets are still required for a subset of accounts.

QAm I affected?

DreamHost says it emailed every affected account owner with instructions (all emails sent by October 25). If an email address or SFTP user on your account no longer accepts its old password, it is affected. You do not need to wait for the email: account owners can set new passwords now at panel.dreamhost.com. If you only use a mailbox or SFTP login on someone else's DreamHost account, ask that account owner.

QWere my emails, files or passwords stolen?

DreamHost has not said. Its notices call the reset a precaution and do not state whether mail, files or passwords were accessed. Its help article says mail accounts keep receiving mail and FTP/SFTP data stays on the server. This article records data access as not stated, not as ruled out.

QWhat caused it?

DreamHost has not said what caused the incident or how many customers are affected. Security news sites that asked DreamHost reported no answer as of their publication. This article does not speculate.

QI got an email asking me to reset my DreamHost password. Is it real?

Do not use its link. DreamHost says it will never email you asking for your password and that its notification will not ask you to log in through a link. Type panel.dreamhost.com into the browser yourself and make changes there. If you did not request a reset email, DreamHost says you can ignore it.

QWhy does DreamHost ask me to check email forwarding?

Its help article asks owners to review the forwarding settings on each address and remove any forward they do not recognise or no longer use. DreamHost does not explain why. In general, a forward copies every incoming message to another address and keeps working after a password change, so it is worth checking even when nothing else looks wrong.