DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident
DreamHost web hosting (email, FTP/SFTP, File Manager)
Since Oct 23 2026, web host DreamHost has been handling an incident that took its File Manager (files.dreamhost.com) offline and disrupted webmail and FTP/SFTP. As a precaution it reset passwords for affected email and FTP/SFTP users, who can't log in until the account owner sets new ones in the DreamHost panel. Notices to customers also say to check every mailbox for forwarding rules and remove unknown destinations, which suggests some mailboxes may have been accessed. DreamHost hasn't said what happened, how many accounts are affected or whether files or mail were exposed. File Manager is still down.
Why this severity: Precautionary credential reset; no confirmed data exposure disclosed yet
- Started
- Oct 23, 2026
Affected
- DreamHost-hosted email and FTP/SFTP users on affected accounts
Fixed in
No fixed release yet
Timeline5
BleepingComputer reports DreamHost also tells owners to remove unknown email forwarding rules and has not answered questions about what was exposed.
All impacted account holders emailed reset instructions; File Manager still being restored.
Password reset for affected email and FTP/SFTP users completed; account owners told to set new passwords in panel.dreamhost.com.
DreamHost starts investigating connectivity issues with its File Manager interface (files.dreamhost.com).
Incident widens to FTP/SFTP and webmail; DreamHost takes File Manager offline and starts resetting some email and FTP/SFTP passwords as a precaution.
Advisories1
News & write-ups1
Notes & caveats
DreamHost serves 400,000+ customers per BleepingComputer. The cause and scope are not disclosed; don't assume a confirmed breach until DreamHost says so.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
