Incident
Published 2026-10-24 New
Updated 2026-10-27
Verified 2026-10-27

DreamHost resets passwords for some email and FTP/SFTP users as a precaution during an ongoing incident that took its File Manager offline and disrupted webmail; the web host has not said what happened

US web host DreamHost says it is investigating an incident affecting several of its services, according to posts on its status page starting on 23 October 2026 (Pacific time), when it first reported connectivity issues with the File Manager interface.

DreamHost said later that day that the panel File Manager (files.dreamhost.com) was offline, that some webmail users had been signed out or saw errors, and that as a precaution it was resetting passwords for some email and FTP/SFTP users.

In its 25 October update, DreamHost says all affected account holders have now been emailed step-by-step instructions to reset passwords for mail and FTP/SFTP users, that those users cannot log in until the account owner sets new passwords and shares them, and that work to restore the File Manager continued; its status page still lists File Manager, Email Hosting and Webmail as under service disruption.

DreamHost has not said what caused the incident or whether any data was accessed. According to BleepingComputer, which reported the incident on 26 October, DreamHost's notifications also advise customers to review each email address for forwarding rules and remove any destination they do not recognise, and DreamHost had not answered BleepingComputer's questions about the number of affected accounts or whether files or messages were exposed.

Updated 27 Oct 2026, 6:35 am Perth (AWST) (3:35 pm PDT, 26 October): DreamHost says on its status page that its engineers have pushed out a fix to the File Manager and files.dreamhost.com is back online, that it is monitoring to make sure the File Manager is fully operational and will update the post when all is clear, and that password resets are still required for a subset of email and FTP/SFTP user accounts. (source: DreamHost status page)

Correction (27 Oct 2026): the card date has moved from 23 to 24 October 2026, the Perth date of DreamHost's first status post (2:20 pm 23 October Pacific time; 5:20 am 24 October Perth). (source: DreamHost status page)

Product
DreamHost web hosting (File Manager, Email Hosting, Webmail, FTP/SFTP users)
Versions
n/a — hosting provider incident; cause not stated
Exploited in Australia?
unknown
Patch to
DreamHost account owners: set new passwords for affected mail and FTP/SFTP users directly in panel.dreamhost.com (Mail > Manage Email or Websites > SFTP Users & Files) and share them with users by phone or another channel; check every mailbox for forwarding rules you did not set (advice reported by BleepingComputer); change any reused passwords elsewhere. DreamHost says it will never email you asking for your password, so ignore reset links you did not request.

breaches cloud