DreamHost Security Incident Forces Password Resets for Email and FTP/SFTP Accounts

DreamHost has implemented forced password resets for certain email and FTP/SFTP accounts following an incident that affected its File Manager and webmail services.

The company restored its browser-based File Manager on October 26, 2026. However, users affected by the incident must obtain new login credentials from their account owners before they can access their accounts.

The disruption began on October 23, when DreamHost reported connectivity issues with the File Manager interface. Later updates revealed that webmail and FTP/SFTP access were also affected, prompting precautionary password resets while engineers investigated.

DreamHost’s guidance indicates that it expired passwords for affected accounts to maintain account security. Although users temporarily lost access, their mailboxes continued to receive messages, and FTP/SFTP user data remains stored on DreamHost’s servers.

On October 26, at 3:35 p.m. PDT, DreamHost announced that engineers had deployed a fix and brought files.dreamhost.com back online. The incident has moved into a monitoring phase, with engineers ensuring File Manager remains fully operational. However, password resets are still required. DreamHost continues to direct affected customers to its knowledge base for account recovery instructions.

Earlier, on October 25 at 9:32 p.m. PDT, the company said all impacted account holders had received instructions. Individual email and FTP/SFTP users remain unable to authenticate until their DreamHost account owner assigns new passwords and shares them.

The published updates do not identify the root cause, disclose the number of affected accounts, or confirm any unauthorized access or data theft. Therefore, these precautionary password resets should not be interpreted as confirmation of a credential breach.

DreamHost’s recovery process places responsibility on the main account holder on individual mailbox or file-transfer users. Administrators need to sign into the DreamHost panel and change credentials through the relevant management pages.

For email accounts, the path is “Mail > Manage Email,” and for FTP/SFTP users, it is “Websites > SFTP Users & Files.” DreamHost advises allowing up to 15 minutes for the changed passwords to take effect and reminds users to update any applications that retain the previous credentials, including email clients and file-transfer software configured with saved passwords. The company also recommends using strong, unique passwords for each user account.

Furthermore, DreamHost resolved a “Failed to edit” error that prevented some Professional Email customers from setting replacement passwords, according to its October 25 update.

During recovery, DreamHost urges administrators to review mailbox forwarding settings and remove any destinations they don’t recognize or no longer use. Although this check accompanies the password changes, the guidance does not confirm that attackers changed forwarding rules.

Account owners should inform affected users through a phone call, secure text, or another private channel outside their DreamHost-hosted mailbox, which they cannot access until they receive new credentials. Throughout the incident, DreamHost has cautioned that it will never request passwords via email and advised customers to go directly to panel.dreamhost.com instead of following login links in messages.

The latest update says the incident remains under monitoring, with File Manager restored but credential recovery still required for affected users.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.