The DreamHost password reset has locked out every email and FTP/SFTP user on affected accounts until the account owner sets new credentials. The incident began with File Manager connectivity problems on October 23. DreamHost has not disclosed a cause.
Key takeaways
- DreamHost forced email and FTP/SFTP password resets after an incident that began October 23.
- A password reset does not remove an email forwarding rule, so audit every mailbox.
- No root cause, affected-account count or confirmation of exposed data has been published.
Why did DreamHost force a password reset?
DreamHost calls the lockout a precaution. File Manager problems that began October 23 spread to other services the company has not detailed, and DreamHost blocked all users until their passwords were reset. Recovery instructions went out in batches over the weekend to every affected account owner, DreamHost says. When BleepingComputer reported the incident, it was still active and File Manager remained unavailable.
No root cause, attack vector, CVE or indicator of compromise has been published, and DreamHost did not answer BleepingComputer’s questions about scope or exposed data. It hasn’t said whether control-panel logins were affected, so change the panel password if it matches any old mailbox or FTP password. DreamHost serves more than 400,000 customers and at least 1.5 million websites and applications, including 750,000 WordPress installations; those figures describe the platform, not the affected accounts.
Why is DreamHost telling you to check email forwarding rules?
A forwarding rule lives in the mailbox configuration, separate from the password, so a forced reset leaves it in place and whoever created it keeps receiving copies of your mail. That is why DreamHost told customers to delete forwarding destinations they don’t recognize. BleepingComputer read this as a sign some mailboxes may have been exposed; DreamHost has not confirmed it.
A hidden forward copies invoices, client mail and password-reset links. Check forwarding, filters and aliases on every address, and screenshot each suspicious rule before deleting it. It may be your only evidence.
Who needs to act when multiple users share an account?
The account owner, because DreamHost cannot contact individual mailbox or FTP users. Reach employees, contractors and developers by phone, text or chat. Any deploy job, backup script or saved client profile holding an FTP/SFTP password will fail until you update it.
DreamHost also advised changing the old password anywhere it was reused, such as a registrar or WordPress admin account. Reused passwords figure heavily in how attackers find weak websites. Expect phishing that copies the reset notices, and type the control panel address yourself.
What should site owners do after the DreamHost password reset?
A reset blocks future logins but can’t tell you whether someone already got in. With File Manager down, SFTP is the practical way to inspect files; DreamHost has not said which file-access methods are fully available.
- Finish the reset for every user, and update credentials stored in scripts and clients.
- Rotate what the reset didn’t cover: SSH keys, database passwords, API tokens and WordPress application passwords.
- Remove WordPress or Joomla admin accounts you didn’t create.
- Inspect wp-config.php, configuration.php and .htaccess for injected code or new redirect rules.
- Hunt for backdoors: compare recently modified PHP files in uploads, cache and theme folders against a known-good backup.
From our incident-response work: after a hosting-level credential incident, the leftover we find most often is a small PHP file dropped weeks earlier that never appears in deployment history. Timestamps tell you where to look, not what is malicious; a full scan with antivirus website protection catches what manual review misses.
Until DreamHost publishes a root cause, assume your account was in scope.
FAQ
Why did DreamHost force a password reset?
DreamHost called it a precaution after File Manager problems that began October 23 spread to other services. No cause has been disclosed.
Should I delete email forwarding rules I don't recognize?
Yes, as DreamHost advised. Screenshot each rule first to record where your mail was going.
Has DreamHost said whether files or emails were exposed?
No. DreamHost has not answered press questions about exposed data or how many accounts were affected.
If your account was affected by this reset, new passwords are only the first step. SiteGuarding can run a malware scan, cleanup and ongoing monitoring to confirm nothing was left behind.