# DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident · pwn.watch > Since Oct 23 2026, web host DreamHost has been handling an incident that took its File Manager (files.dreamhost.com) offline and disrupted webmail and FTP/SFTP. As a precaution it reset passwords for affected email and FTP/SFTP users, who can't log in until the account owner sets new ones in the DreamHost panel. Notices to customers also say to check every mailbox for forwarding rules and remove unknown destinations, which suggests some mailboxes may have been accessed. DreamHost hasn't said what happened, how many accounts are affected or whether files or mail were exposed. File Manager came back online on Oct 26 and DreamHost is monitoring, but affected users still need new passwords. Page: https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026 · generated 2026-10-26T23:24:06.493Z ## Status - Severity: medium · status: live · patch: partial - Product: DreamHost web hosting (email, FTP/SFTP, File Manager) - Started: 2026-10-23 - Affected: DreamHost-hosted email and FTP/SFTP users on affected accounts ## Follow this incident - RSS (one item per update): https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026.json - This file: https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: BleepingComputer reports DreamHost also tells owners to remove unknown email forwarding rules and has not answered questions about what was exposed. (https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/) - 2026-10-26: DreamHost pushes a fix and brings File Manager (files.dreamhost.com) back online, moving the incident to monitoring; password resets are still required for a subset of email and FTP/SFTP users. (https://www.dreamhoststatus.com/) - 2026-10-25: All impacted account holders emailed reset instructions; File Manager still being restored. (https://www.dreamhoststatus.com/) - 2026-10-24: Password reset for affected email and FTP/SFTP users completed; account owners told to set new passwords in panel.dreamhost.com. (https://www.dreamhoststatus.com/) - 2026-10-23: DreamHost starts investigating connectivity issues with its File Manager interface (files.dreamhost.com). (https://www.dreamhoststatus.com/) - 2026-10-23: Incident widens to FTP/SFTP and webmail; DreamHost takes File Manager offline and starts resetting some email and FTP/SFTP passwords as a precaution. (https://www.dreamhoststatus.com/) ## Fix brief # Security brief: DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident Source: https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026 · status: live · severity: medium · updated Oct 26, 2026, 22:52 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Since Oct 23 2026, web host DreamHost has been handling an incident that took its File Manager (files.dreamhost.com) offline and disrupted webmail and FTP/SFTP. As a precaution it reset passwords for affected email and FTP/SFTP users, who can't log in until the account owner sets new ones in the DreamHost panel. Notices to customers also say to check every mailbox for forwarding rules and remove unknown destinations, which suggests some mailboxes may have been accessed. DreamHost hasn't said what happened, how many accounts are affected or whether files or mail were exposed. File Manager came back online on Oct 26 and DreamHost is monitoring, but affected users still need new passwords. Severity detail: Precautionary credential reset; no confirmed data exposure disclosed yet - Product: DreamHost web hosting (email, FTP/SFTP, File Manager) ## Affected versions - DreamHost-hosted email and FTP/SFTP users on affected accounts ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you host on DreamHost: set new passwords for mail and FTP/SFTP users only via panel.dreamhost.com (not links in email), check every mailbox for forwarding rules you don't recognize, change any reused DreamHost passwords elsewhere, and tell your mailbox users by phone or text since they may be locked out. ## Latest updates - Oct 26, 2026: BleepingComputer reports DreamHost also tells owners to remove unknown email forwarding rules and has not answered questions about what was exposed. - Oct 26, 2026: DreamHost pushes a fix and brings File Manager (files.dreamhost.com) back online, moving the incident to monitoring; password resets are still required for a subset of email and FTP/SFTP users. - Oct 25, 2026: All impacted account holders emailed reset instructions; File Manager still being restored. - Oct 24, 2026: Password reset for affected email and FTP/SFTP users completed; account owners told to set new passwords in panel.dreamhost.com. - Oct 23, 2026: DreamHost starts investigating connectivity issues with its File Manager interface (files.dreamhost.com). - Oct 23, 2026: Incident widens to FTP/SFTP and webmail; DreamHost takes File Manager offline and starts resetting some email and FTP/SFTP passwords as a precaution. ## Advisories - [Investigating an incident affecting File Manager and Webmail Service Disruption](https://www.dreamhoststatus.com/) (DreamHost) ## Write-ups & news - [DreamHost forces password resets in ongoing "incident"](https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/) ## Caveats DreamHost serves 400,000+ customers per BleepingComputer. The cause and scope are not disclosed; don't assume a confirmed breach until DreamHost says so. --- Machine-readable: https://pwn.watch/i/dreamhost-email-ftp-password-reset-incident-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.