DreamHost has forced password resets for all email and FTP/SFTP users after a security incident that first knocked out its File Manager and then spread to other services. The web host says the resets are a precaution, but its own advice to customers hints at something worse: it is asking users to check their mailboxes for forwarding rules they do not recognise.
Here is what happened, what DreamHost has confirmed so far, and exactly what affected users should do next.
What Happened
The incident started on October 23, 2026, when DreamHost reported connectivity problems affecting its File Manager interface. The impact quickly expanded to other services, and the company responded by blocking access to all users until they completed password resets.
Over the weekend, DreamHost sent recovery instructions to affected account owners in batches. As of October 26, when BleepingComputer first reported on the incident, it was still active and File Manager access was still unavailable.
The current state of things, based on DreamHost’s status page and customer notifications:
- All affected account owners have received recovery instructions
- Mailbox and FTP/SFTP users cannot log in until their account owner sets new credentials for them
- DreamHost says it cannot contact individual mailbox or FTP users directly, so account owners have to pass the message on by phone, text or other means
- File Manager remains down while the investigation continues
Why the Forwarding Rules Warning Matters
The most telling detail is in the notification DreamHost sent to impacted account holders. Besides asking users to reset passwords, it advises them to review each email address for forwarding rules and remove any forwarding destination they do not recognise.
That kind of warning usually appears when there is a real possibility that intruders set up mail forwarding inside compromised accounts, quietly copying incoming email to external addresses. DreamHost has not said whether files or messages were exposed, and the company has not confirmed a data breach.
Security publication BleepingComputer contacted DreamHost multiple times with questions about the incident, the number of impacted accounts, and whether any data was exposed. The company had not responded as of publication.
How Big Is DreamHost?
DreamHost is a US web hosting provider and domain registrar that offers WordPress hosting, business email, virtual private servers, dedicated servers, and cloud services. According to its own company page, it serves over 400,000 customers in more than 100 countries and supports at least 1.5 million websites and applications, including 750,000 WordPress installations.
That scale is why this incident matters even without confirmed data loss. A hosting panel compromise on this platform could touch a very large number of small business sites and mailboxes.
Customers Want Answers
Long-time DreamHost customers are complaining about the lack of information. On Hacker News, one customer wrote: “It’s disturbing to get these emails with zero explanation what’s going on, and very frustrating that user community has to guess.”
That frustration is understandable. Forced password resets across an entire mail platform are a strong signal on their own, and users are being asked to act without being told what the exposure actually is.
What DreamHost Users Should Do Now
If you host with DreamHost or use DreamHost email, work through this list today:
- Complete the password reset. Follow the recovery instructions DreamHost sent to the account owner. Mailbox and FTP users stay locked out until the account owner sets new credentials.
- Check forwarding rules on every mailbox. Log in to the panel and review email forwarding. Delete any forwarding destination you or your team did not set up.
- Check autoresponders and filters too. Intruders who get mailbox access often leave rules behind that copy or redirect mail.
- Assume the old password is burned. If you reused your DreamHost password anywhere else, change it on those services as well.
- Enable two-factor authentication on the DreamHost panel and on any linked accounts that support it.
- Warn your users. If you manage mailboxes for other people, tell them directly. DreamHost cannot reach mailbox users themselves, and those users may not be able to read their email until you act.
- Keep site backups offline. With File Manager down and the incident ongoing, this is a good moment to verify your last known good backup is stored somewhere other than DreamHost.
Is My Website Data Safe?
Nobody outside DreamHost can answer that yet. The company has described the action as a precaution and has not confirmed data theft. The forwarding rules advice suggests at least some mailboxes were touched, but DreamHost has provided no numbers.
The safe assumption until DreamHost clarifies is that anything sitting in DreamHost email or FTP storage should be treated as potentially exposed. That means rotating API keys, database passwords, and CMS admin credentials that may have been mailed or stored in plain text.
Hosting Providers Are Having a Rough Month
The DreamHost incident lands in a busy stretch of attacks on hosting and developer platforms. In just the last few weeks, Japan’s Onamae Desktop Cloud was hacked with up to 27,000 servers affected, and its parent company GMO urged customers to shut down PCs amid a ransomware threat. Developer platform Railway warned users to rotate secrets after a potential breach, and hosting startup Zeabur said it is shutting down after its second security breach in two months.
If you rely on a hosting provider, the pattern is worth remembering: your security is only as good as their panel security. Keep independent backups and unique passwords so a provider incident does not become a catastrophe for you.
FAQ
Did DreamHost get hacked?
DreamHost has not confirmed a breach. It says an incident disrupted File Manager and other services, and it forced password resets as a precaution. Its advice to check email forwarding rules suggests some mailboxes may have been exposed, but the company has not provided details.
Why did DreamHost reset my email password?
DreamHost forced password resets for email and FTP/SFTP users after the incident that began on October 23, 2026. Mailbox users are locked out until their account owner sets new credentials using the recovery instructions DreamHost sent.
Is DreamHost File Manager still down?
Yes. As of October 26, 2026, the incident remained active and File Manager access was still unavailable. Check DreamHost’s status page for the latest updates.
What should I do after the DreamHost password reset?
Set a new unique password, check every mailbox for unknown forwarding rules, enable two-factor authentication, and change the old password on any other service where you reused it. Also confirm your website backups are stored outside DreamHost.
