DreamHost Forces Email and FTP Password Resets Amid File Manager Outage

What DreamHost has confirmed​

DreamHost's status page lists the incident as a "Service Disruption." The affected components are Web Services and Email Services. The named locations are the File Manager Interface, Email Hosting and Webmail Interface. Web Hosting, VPS, Dedicated Server Hosting, Database Hosting, Domain Registrations and DreamCompute show as operational.

The timeline, in Pacific time:

• Oct 23, 2:20 p.m.: DreamHost's Operations team reported connectivity issues with the File Manager.
• Oct 23, 5:20 p.m.: The File Manager was offline. Some webmail users had been signed out or hit login errors, and DreamHost announced precautionary password resets that later extended to FTP/SFTP users.
• Oct 23, 10:13 p.m.: The resets covered some email and FTP/SFTP users. DreamHost asked customers to wait for its email, because changes made before the reset finished would be overwritten.
• Oct 24, 10:37 a.m.: DreamHost said the resets were complete. Account owners could set new passwords without waiting for the email.
• Oct 25, 11:43 a.m.: Some Professional Email customers had seen a "Failed to edit" error when setting a new password. DreamHost said that was fixed.
• Oct 25, 9:32 p.m.: All impacted account holders had been emailed step-by-step instructions. The File Manager at files.dreamhost.com was still down, with no restoration time given.

Why recovery depends on the account owner​

Affected mailbox and FTP/SFTP users can't fix this themselves. DreamHost's status page says they should contact their account owner, who can set a new password for them. The owner's email says the affected passwords have expired and no replacements have been assigned.

The owner's email also says DreamHost can't contact individual mailbox or FTP users directly. So owners need to tell people by phone, text or another channel. That is a real problem for a small company where the only copy of the instructions sits in a mailbox that no longer works.

Resets also break more than webmail. DreamHost warned that webmail and email apps such as Outlook, Apple Mail and phone clients will stop accepting the old password. If you have mail clients configured on laptops, phones or shared mailboxes, expect authentication failures until each one is updated.

What to do if you own a DreamHost account​

The steps below come from DreamHost's status page and from the account-owner email as reported by webhosting.today.

1. Go directly to panel.dreamhost.com. Don't follow a link in an email. DreamHost says it will never email you asking for your password.
2. Set mail passwords under Mail > Manage Email.
3. Set FTP/SFTP passwords under Websites > SFTP Users & Files.
4. Allow up to 15 minutes before testing the new password.
5. Webhosting.today reports that the owner email asks you to update passwords for every email and FTP/SFTP user, not only the expired ones.
6. Review the forwarding settings on each email address. Remove any destination you don't recognize.
7. Tell affected users through a channel outside DreamHost mail.
8. If an old DreamHost password was reused on another service, change it there too.

After the resets, update the saved credentials in every place that logs in as one of these users. That includes deployment scripts, CI/CD jobs, backup tools and FTP clients. A stale password in an automated job can look like an unrelated outage.

Phishing risk​

DreamHost's guidance is blunt. Its notifications won't ask you to log in through a link. If you get a password reset email you didn't request, you can ignore it. Webhosting.today also reports that email and FTP/SFTP users don't receive password reset emails from DreamHost for any reason. Forced-reset events are a good time for phishers to send fake "verify your password" messages. Any such message should be treated as hostile.

What we don't know​

The public evidence doesn't establish a breach. DreamHost's status page doesn't identify a cause, say an intrusion occurred, or say how many accounts are affected. The forwarding-rule check is a precaution. It isn't proof that anyone added malicious forwards. Still, BleepingComputer notes it suggests some mailboxes may have been exposed to outside parties, though DreamHost gave no further detail.

BleepingComputer says it contacted DreamHost several times about the number of impacted accounts and whether files or messages were exposed. It had no reply when it published.

That silence is frustrating customers. BleepingComputer quoted one who called it "disturbing" to get these emails "with zero explanation." A community summary on daily.dev says some commenters speculate the File Manager is a third-party PHP tool (Monsta FTP) that may have leaked FTP credentials. That is unverified speculation from forum users. Neither DreamHost nor the reporting I reviewed supports it, so don't treat it as fact.

Context and takeaways​

This isn't DreamHost's first FTP-password reset. In January 2012, DreamHost reset FTP and shell passwords for all customers after detecting unauthorized activity in one of its databases. The cause then was confirmed, and it was a breach. This time no cause has been given, so the two events shouldn't be equated.

For IT admins, three lessons stand out:

• Know who owns the account. Recovery in this incident runs through the primary account owner. Make sure that person is reachable.
• Keep a contact path that doesn't depend on hosted email. Owners need a way to reach users when mail is down.
• Don't reuse passwords across hosting, mail and other services. That is the one step DreamHost explicitly told customers to take elsewhere.

Treat the incident as live. DreamHost said it will post an update when the File Manager is restored, and its status page is the place to follow that. Until DreamHost explains the cause, the sensible stance is to assume nothing about exposure and to rotate credentials.