DreamHost forces email and FTP/SFTP password resets after File Manager incident; service restored, cause undisclosed

Linha do tempo

1. securityweek.com ↗ · pub. 27/10/2026 09:02 · coletado 27/10 11:00

   DreamHost suspends File Manager and resets email and FTP/SFTP passwords after unexplained incident

   ler a análise desta fonte ocultar

   Web hosting provider DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users over the weekend. The company cited only "an issue" with its systems that affected File Manager and DreamHost webmail, and described the resets as a precaution. It has not disclosed the root cause, the number of affected users, or whether credentials were exposed. Some users speculated that passwords were compromised and questioned whether they were properly hashed, and DreamHost has not confirmed either point. On Monday the company said it had deployed a fix and restored File Manager access, and that it was still monitoring the service. SecurityWeek has asked DreamHost about the scope and root cause.

   Technical Details

   • Affected services: File Manager at files.dreamhost.com and DreamHost webmail.
   • Password resets applied to some email and FTP/SFTP users. Only the account owner can set the new passwords, and mailbox and FTP users are not contacted directly.
   • DreamHost stated it would not request password resets via email.
   • No evidence of data theft, attacker activity or password exposure was stated in the article.

   Remediation

   • Account owners should set new passwords for affected email and FTP/SFTP users and tell those users about the reset.
   • Users who reused the old password elsewhere should change it on those services.
   • Treat any email claiming to be a DreamHost password reset as suspicious, since DreamHost says it does not send them.
2. gbhackers.com ↗ · pub. 27/10/2026 05:52 · coletado 27/10 09:00

   DreamHost forces password resets for email and FTP/SFTP accounts after File Manager and webmail incident

   ler a análise desta fonte ocultar

   DreamHost expired passwords for certain email and FTP/SFTP accounts after an incident that disrupted its File Manager and webmail services starting October 23, 2026. The company restored files.dreamhost.com on October 26 and moved the incident to a monitoring phase, but affected users still cannot authenticate until the main account owner assigns new passwords. Mailboxes kept receiving messages and FTP/SFTP data remains on DreamHost servers. The published updates do not state the root cause, the number of affected accounts, or whether there was unauthorized access or data theft, so the resets should not be read as confirmation of a credential breach.

   Technical Details

   • Disruption began October 23 with File Manager connectivity issues, later extending to webmail and FTP/SFTP access.
   • Passwords for affected accounts were expired as a precaution while engineers investigated.
   • A fix was deployed on October 26 (3:35 p.m. PDT) and File Manager was brought back online.
   • A "Failed to edit" error that blocked some Professional Email customers from setting new passwords was fixed on October 25.
   • DreamHost asks administrators to review mailbox forwarding rules and remove unrecognized destinations. The guidance does not confirm that attackers changed any forwarding rules.

   Remediation

   • Account owners reset credentials in the DreamHost panel: Mail > Manage Email for email accounts, Websites > SFTP Users & Files for FTP/SFTP users. Changes can take up to 15 minutes to apply.
   • Update saved passwords in email clients and file-transfer software.
   • Use strong, unique passwords for each user.
   • Share new credentials through a private channel outside the DreamHost-hosted mailbox, such as a phone call or secure text.
   • Review and remove unknown mailbox forwarding destinations.
   • DreamHost never asks for passwords by email. Go directly to panel.dreamhost.com instead of following login links in messages.
3. bleepingcomputer.com ↗ · pub. 26/10/2026 16:26 · coletado 26/10 17:00 primeiro registro

   DreamHost forces email and FTP/SFTP password resets during ongoing security incident

   ler a análise desta fonte ocultar

   DreamHost, a U.S. web hosting provider and domain registrar, has forced password resets for email and FTP/SFTP users after an incident that began on October 23 as connectivity problems with the File Manager interface and then spread to other services. The company blocked access for all users until the account owner sets new credentials, calling this a precaution. As of publication the incident remains active and File Manager is still unavailable. DreamHost has not disclosed the cause, the number of affected accounts, or whether files or messages were exposed. BleepingComputer's questions went unanswered, and customers are complaining about the lack of communication.

   Technical Details

   • The incident was first reported on October 23 as File Manager connectivity problems, then expanded to other services.
   • Recovery instructions were sent in batches over the weekend to all affected account owners.
   • DreamHost advises reviewing every email address for forwarding rules and removing any unrecognized forwarding destination. This suggests some mailboxes may have been accessed by external actors, but DreamHost has not confirmed it.
   • DreamHost cannot contact individual mailbox or FTP users directly, so account owners must notify them by phone, text or other means.
   • No attribution, malware, CVE or IOCs have been published.

   Remediation

   • Account owners should set new credentials for affected email and FTP/SFTP accounts.
   • Check each mailbox for forwarding rules and remove any destination you do not recognize.
   • Change the password on any other service where the old DreamHost password was reused.
   • Notify affected mailbox and FTP users through out-of-band channels.