Tech News · Cybersecurity
DreamHost password reset — what it means for your business
“As a precaution, we are resetting passwords for some email and FTP/SFTP users.”
— DreamHost, DreamHost Status
What happened
A DreamHost password reset is now required for a subset of email and FTP/SFTP accounts after the web host began investigating a service incident on October 23, 2026. DreamHost locked affected mailbox and file-transfer users out until the account owner sets new credentials, and it emailed recovery instructions to those owners in batches over the weekend.
The trouble started as connectivity problems with DreamHost’s browser-based File Manager, then spread to webmail, where some users were signed out. According to DreamHost’s status page, the File Manager fix was deployed on the afternoon of October 26 (Pacific time) and the incident moved to a monitoring stage, but password resets are still needed for some email and FTP/SFTP accounts. Website hosting and the main control panel stayed up, CyberInsider reported, citing the status page.
DreamHost has not said what caused the incident or how many customers are affected. BleepingComputer reported that it contacted the company several times about whether files or messages were exposed and had not received an answer at publication. The host serves more than 400,000 customers and over 1.5 million websites, according to CyberInsider.
Two details matter most for business owners. First, only the account owner can set the replacement passwords; DreamHost says it cannot contact individual mailbox or FTP users, so the owner has to tell staff and contractors directly. Second, the notice to account holders asks them to check every mailbox’s forwarding rules and remove any destination they don’t recognize.
FuzeForth’s take
This is a hosting incident, not a flaw in WordPress, but it lands on the same people: small businesses whose website, email and file access all live with one provider. When the host resets credentials and won’t explain why, the safest move is to act as if those passwords may have been exposed. The forwarding-rule warning is the strongest hint. A silent forwarding rule is a classic way to read a company’s invoices and customer emails without anyone noticing, so check it even if your mailbox still works.
If you host with DreamHost, do this today: set new passwords for every affected mailbox and FTP/SFTP user from the control panel, tell each person by phone or text (not by email to the locked mailbox), review forwarding rules on every address, and change any other account that reused an old DreamHost password. Treat any email asking you to “confirm” or “send” a password with suspicion; DreamHost says it will never ask for passwords by email, and incidents like this attract phishing. While you’re in the panel, make sure two-factor sign-in is on for the owner account and confirm you have a recent off-site backup of your site files.
Even if you’re not a DreamHost customer, use this as a drill. Do you know who holds the owner login for your hosting? Could you reach every mailbox user without email? Does anyone still use plain FTP? Businesses that can answer those questions in minutes recover in hours instead of days. If you’d rather have someone watch logins, updates and backups for you, our website care and security plans cover exactly this, and if your site is overdue for a move to modern, secure hosting, a website rebuild and migration is a good time to clean up old FTP accounts for good.
Key points
- DreamHost began investigating File Manager problems on October 23, 2026, and reset passwords for some email and FTP/SFTP users as a precaution.
- Affected users can’t sign in until the account owner sets a new password in the DreamHost panel; DreamHost can’t notify individual mailbox users.
- File Manager was restored on October 26 and the incident is being monitored, but some accounts still need password resets.
- DreamHost hasn’t disclosed the cause or how many customers were affected.
- Owners should check every mailbox’s forwarding rules, change reused passwords and watch for phishing.
Frequently asked questions
Was DreamHost hacked?
DreamHost hasn’t said. It describes the password resets as a precaution and has not disclosed the cause, but its advice to remove unknown forwarding rules suggests owners should assume some mailboxes may have been accessed until told otherwise.
How do I complete the DreamHost password reset for email and FTP?
Sign in to the DreamHost panel as the account owner. Email passwords are changed under Mail > Manage Email, and FTP/SFTP passwords under Websites > SFTP Users & Files; changes can take up to 15 minutes to apply, per CyberInsider.
Is my DreamHost website down because of this incident?
Not according to reports: website hosting and the main control panel remained operational. The affected services were File Manager, email hosting and webmail, plus FTP/SFTP logins for reset users.
