Due to a disruption of access to DreamHost's File Manager and webmail services as a result of an incident, certain email and FTP/SFTP accounts were forced to reset their passwords. Although the hosting provider described the action as a precautionary security measure, it has not yet revealed the cause of the incident or confirmed whether any accounts have been accessed without authorization.
When DreamHost first detected connectivity problems affecting its file manager on the web at files.dreamhost.com on October 23, 2026, the disruption was initially reported. As a consequence, some webmail users experienced login failures, while FTP/SFTP access was also affected by the issue. As a result, the company reset passwords for affected accounts and temporarily restricted access until new credentials could be established.
When a DreamHost account owner assigns a replacement password to the affected mailbox and file transfer users, the users cannot sign in. By the weekend, DreamHost mailed recovery instructions to all affected account holders in stages and confirmed to all affected account holders that all were notified by October 25.
In October, the company reported that engineers had deployed a fix and had restored File Manager functionality. Monitoring continued to ensure that the service continued to operate, however password changes for affected accounts continued to be required. Since limited information has been released by the company about the incident, customers have expressed concern.
Neither DreamHost nor the company has identified the root cause, disclosed the number of accounts affected, or confirmed whether any email messages, stored files, or login credentials have been compromised. Also, the provider advised users to review their mailbox forwarding settings and remove any unfamiliar destinations. This setting can be abused in order to redirect sensitive communications outside a company, thereby making it a crucial element of account security.
DreamHost has, however, not confirmed that unauthorized forwarding rules have been created in this incident. Additionally, customers have expressed concern about the lack of detailed explanations for the disruptions in service as well as mandatory password changes. Despite speculation about a possible compromise, no publicly available confirmation has been provided to indicate that an attack or data breach has occurred.
According to DreamHost, account owners should update stored credentials across connected applications and review account settings in order to complete the recovery process. Email clients, FTP/SFTP software, website backup tools, deployment systems and plugins relying on previously stored credentials may be affected by password changes.
In order to avoid the possibility of affected users losing access to their hosted mailboxes, the company recommends that replacement passwords be shared through private channels, such as telephone calls or secure text messages. The recovery guidance provided by DreamHost specifies that mailbox passwords can be changed under “Mail > Manage Email” in the control panel, and FTP/SFTP credentials can be updated under “Websites > SFTP Users & Files”.
If you changed your password before the reset process was completed, you should verify that your new password remains valid as well. Password changes may take up to 15 minutes to become effective. There is no indication that incoming email is reaching affected mailboxes, and that FTP/SFTP data is still stored on the provider's servers.
In addition to these assurances concerning service and data availability, it is also recommended that website owners conduct routine site checks to determine whether unauthorized access occurred prior to the password reset. Considering that FTP/SFTP credentials provide access to website files, it is important to identify suspicious changes by reviewing recently modified files, unfamiliar administrator accounts, and unforeseen scheduled tasks.
There has been no evidence published to indicate that DreamHost-hosted websites were altered as a result of the incident. This episode also underscores the importance of using third-party hosting providers for security reasons. When a hosting company encounters a disruption, several connected services may be affected at once, especially when email addresses and file transfer credentials are handled by the same provider.
In order to ensure that essential operations are resumed after the password change, DreamHost has repeatedly warned customers that it will never send customers passwords by email. Businesses using DreamHost may need to check integrations and automated processes reliant on these accounts. Rather than logging into the control panel through unsolicited messages, account owners should access the control panel directly.
No public explanation has yet been provided by the company as to what triggered the incident or the number of affected customers has been confirmed. In the interim, a central question remains as to whether the incident involved unauthorized access, how many accounts were affected, and if any customer information was revealed. Despite DreamHost's password reset process and restoration of File Manager access, the broader issues associated with the incident haven't been resolved.
DreamHost's restoration of File Manager access marks progress in the recovery process, but the absence of an identified root cause leaves the incident's broader security implications unresolved. While the company has yet to clarify the cause of the incident, and whether any customer accounts or data has been accessed, it remains unclear how the incident will impact the security of the company.