● Covered by 4 sources · 5 reportsMedium impact4 negative1 neutral
DreamHost Initiates Mandatory Password Reset for Affected Email and FTP/SFTP Users
Key points
- DreamHost is forcing password resets for affected users.
- Account owners can reset passwords through the DreamHost control panel.
- Instructional emails are being sent in batches.
- The File Manager at files.dreamhost.com remains unavailable.
- DreamHost forced password resets for email and FTP/SFTP users.
- DreamHost is a U.S. web hosting provider and domain registrar.
- DreamHost serves over 400,000 customers in more than 100 countries.
- DreamHost supports at least 1.5 million websites and applications.
- DreamHost supports 750,000 WordPress installations.
- DreamHost initially reported connectivity problems on October 23.
- The incident remains active.
- DreamHost suspended its File Manager service.
- DreamHost reset some user passwords over the weekend.
- DreamHost notified account owners via private communication.
- DreamHost told account owners to inform individual mailbox or FTP users.
- DreamHost advised users to change old passwords used elsewhere.
- Attackers accessed DreamHost's File Manager platform for two months.
- The breach occurred between August 2026 and October 23, 2026.
- The intruder may have accessed webmail systems, exposing session information.
- The attack exploited a vulnerability in DreamHost's file manager.
- The number of affected customers is "well under 10%" of 400,000.
Mandatory Password Reset Underway
DreamHost has initiated a mandatory password reset for affected email and FTP/SFTP users following an active incident. The company is sending emails with step-by-step instructions to account owners, with completion expected today. Account owners do not need to wait for these emails and can reset passwords immediately through the DreamHost control panel.
Password Reset Process
Account owners can set new passwords by logging into panel.dreamhost.com and navigating to “Mail > Manage Email” or “Websites > SFTP Users & Files”. A new password may take up to 15 minutes to take effect. Email or FTP users who are not account owners should contact their account owner to have their passwords reset.
Resolved Issues and Current Status
An issue where some Professional Email service customers received a “Failed to edit” error when setting new email passwords has been fixed. Affected users are advised to try resetting their passwords again. The File Manager at files.dreamhost.com remains unavailable as DreamHost continues to work on its restoration.
Security Reminders
DreamHost reminds users that it will never email asking for passwords or request logins via links. Users are advised to go directly to panel.dreamhost.com for any changes and to ignore unsolicited password reset emails.
Updates
- Attackers accessed DreamHost's File Manager platform for two months.
- The breach occurred between August 2026 and October 23, 2026.
- The intruder may have accessed webmail systems, exposing session information.
- The attack exploited a vulnerability in DreamHost's file manager.
- The number of affected customers is "well under 10%" of 400,000.
- DreamHost suspended its File Manager service.
- DreamHost reset some user passwords over the weekend.
- DreamHost notified account owners via private communication.
- DreamHost told account owners to inform individual mailbox or FTP users.
- DreamHost advised users to change old passwords used elsewhere.
- DreamHost forced password resets for email and FTP/SFTP users.
- DreamHost is a U.S. web hosting provider and domain registrar.
- DreamHost serves over 400,000 customers in more than 100 countries.
- DreamHost supports at least 1.5 million websites and applications.
- DreamHost supports 750,000 WordPress installations.
- DreamHost initially reported connectivity problems on October 23.
- The incident remains active.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
DreamHost disclosed a data breach where hackers stole customer emails and credentials, including session tokens, over several months. The attack exploited a vulnerability in DreamHost's file manager, affecting "well under 10%" of its 400,000 customers.
DreamHost confirmed a data breach where attackers accessed its File Manager platform for two months, stealing FTP/SFTP usernames and passwords. The breach, occurring between August and October 2026, also potentially exposed webmail session information for some users. DreamHost has blocked access, addressed the vulnerability, and invalidated affected passwords, advising users to check for unauthorized changes and change credentials.
Web hosting provider DreamHost suspended its File Manager service and initiated password resets for some email and FTP/SFTP users over the weekend due to an unspecified "issue" with its systems. The company has not disclosed the root cause or the number of affected users, leading to user concerns about transparency and potential compromise.
DreamHost has initiated mandatory password resets for email and FTP/SFTP users after an incident disrupted its File Manager interface and expanded to other services. The company has not provided details on the nature of the incident, leading to user speculation about potential breaches and compromised email accounts.
DreamHost is requiring a password reset for some email and FTP/SFTP users due to an active incident. Account owners can reset passwords via the control panel, and emails with instructions are being sent in batches.