Security notice
Site or email on DreamHost? Some passwords were reset. Set new ones today.
Since October 23, 2026, web host DreamHost has been dealing with an incident that took its File Manager offline and disrupted webmail and FTP/SFTP. As a precaution, DreamHost says, it reset passwords for some email and FTP/SFTP users. Those users cannot sign in until the DreamHost account owner sets new passwords in the control panel. DreamHost has not said what caused the incident, how many customers are affected, or whether any files or email were exposed, and it has not said it was breached. We are not saying it was. If your website or business email is hosted at DreamHost, log in to your DreamHost panel directly today, set new passwords for the affected email and FTP/SFTP users, and check your site files.
What happened
- How it started. On the afternoon of October 23, DreamHost said its operations team was investigating connection problems with the File Manager, the file tool in its control panel. A few hours later it described an incident affecting several services: File Manager (files.dreamhost.com) was offline, and some webmail users had been signed out or saw errors when logging in. (DreamHost status)
- Passwords reset "as a precaution." That evening DreamHost said the issue also affected FTP/SFTP access and webmail, and that "as a precaution, we are resetting passwords for some email and FTP/SFTP users." On October 24 it said the reset was complete and began emailing affected account owners in batches. By the evening of October 25 it said all affected account holders had been emailed. (DreamHost status)
- Affected users are locked out until the owner acts. DreamHost says these users "will be unable to log in until the owner of their DreamHost account resets their passwords and shares the new credentials with them." It cannot contact individual mailbox or FTP users directly, so account owners need to tell them. DreamHost says mail accounts keep receiving mail and FTP/SFTP user data stays on the server. (DreamHost status, DreamHost Knowledge Base, SecurityWeek)
- File Manager is back, the incident is not closed. On October 26, DreamHost said it pushed out a fix and files.dreamhost.com was back online, that it is monitoring to make sure File Manager is fully working, and that password resets are still required for a subset of email and FTP/SFTP accounts. When we checked its status page at about 8:15 AM ET on October 27, the incident was still open, the latest update was that one from October 26, and File Manager, email hosting and webmail were still listed as "Service Disruption." (DreamHost status, Help Net Security)
- What DreamHost has not said. Help Net Security, BleepingComputer and SecurityWeek all report that DreamHost has not said what caused the incident or how many customers are affected, and BleepingComputer says DreamHost did not answer its questions about whether files or messages were exposed. DreamHost has not said that it was breached or that any customer data was taken. We did not find a statement from DreamHost either way, and we cannot tell you what happened.
- What customers are saying. Some customers have complained about how little DreamHost has explained, and some have speculated online that their passwords were exposed or that the incident is linked to the recent PHP flaws. None of that is confirmed. Separately, DreamHost's notice to account owners tells them to check each email address for forwarding rules and remove any it does not recognize. BleepingComputer says this "suggests that some email accounts may have been breached," but also says DreamHost gave no further details. (DreamHost Knowledge Base, BleepingComputer, Help Net Security)
Who should worry
- Your website, business email or FTP/SFTP logins are hosted with DreamHost.
- You are the DreamHost account owner and received an email about password resets, or someone on your team, a client or a family member could not sign in to email or FTP.
- A developer or agency uploads files to your site over FTP or SFTP.
- You are not sure who hosts your site or email. Ask.
An email password can open an inbox, and inboxes often hold password reset links for other services. An FTP or SFTP login can change the files your website serves. That is why a reset is a sensible precaution, whatever the cause turns out to be. DreamHost says it will not email you asking for your password, and it asks everyone to go directly to its panel. (DreamHost status)
What to do now
Do these today.
- Ask the question. Send the message below to your developer, agency or whoever runs your site and email. You need a clear answer: is any of it on DreamHost?
- Account owners: set new passwords in the panel. Type panel.dreamhost.com into your browser yourself. For email users, go to Mail > Manage Email. For FTP/SFTP users, go to Websites > SFTP Users & Files. DreamHost says you do not need to wait for its email, a new password can take up to 15 minutes to work, and you should use a strong, different password for each user. (DreamHost status, DreamHost Knowledge Base)
- Tell the people who use those accounts. DreamHost says to reach them by phone, secure text or another private channel, not their DreamHost-hosted email, because they cannot open their inbox until they have the new password. Update any email app or FTP program that has the old password saved. (DreamHost Knowledge Base)
- Check email forwarding. DreamHost says to review the forwarding settings on each email address and remove any forward you do not recognize or no longer use. (DreamHost Knowledge Base)
- Change reused passwords elsewhere. DreamHost tells account owners that if a user reused the old password anywhere else, they should change it there too. (SecurityWeek)
- If you or your developer use FTP or SFTP, check your site files. Look for files you do not recognize and changes you did not make, and compare against a recent backup if you have one. This is our advice. DreamHost has not said that any site files were changed.
- Ignore reset emails you did not ask for. DreamHost says it will never email you asking for your password, its notice will not ask you to log in through a link, and a password reset email you did not request can be ignored. Fake messages that copy a real incident are common, so go to the panel directly. (DreamHost status)
What to send your developer, agency or host
Since October 23, 2026, DreamHost has been handling an incident that took its File Manager offline and disrupted webmail and FTP/SFTP. As a precaution it reset passwords for some email and FTP/SFTP users, who cannot sign in until the DreamHost account owner sets new passwords. DreamHost has not said what caused the incident or whether any files or email were exposed. Please confirm whether any of our website, email or FTP/SFTP logins are on DreamHost. If so, please set new, unique passwords for every email and FTP/SFTP user from the DreamHost panel, remove email forwarding rules we do not recognize, change any reused passwords elsewhere, check our site files for changes we did not make, and tell us what you find. Sources: DreamHost status, DreamHost Knowledge Base, Help Net Security.
Common questions
Has my site or business been hacked?
This notice does not mean your site or business has been hacked. DreamHost has not said that it was breached or that any customer data was exposed. It has said it reset some passwords as a precaution. We have no evidence about any individual site, and neither do the reports we found.
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We do not test for this. We cannot see your DreamHost panel, your email accounts, your FTP/SFTP logins, your forwarding rules or your server logs, so we cannot tell whether your passwords were reset or whether anything was accessed. Your account owner and DreamHost can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
Is this connected to the PHP flaws?
Some DreamHost customers have asked. DreamHost has not said what caused the incident, so we cannot say.
I do not use DreamHost. Do I need to do anything?
Not for this incident. If you are not sure who hosts your site or email, ask your developer.
Where can I follow official updates?
The DreamHost status page and its Knowledge Base notice.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- DreamHost: DreamHost Status, Investigating an incident affecting File Manager and Webmail, updates from October 23 to October 26, 2026, checked October 27, 2026, about 8:15 AM ET
- DreamHost: Current Status Notifications (Knowledge Base), October 25, 2026, article updated October 26, 2026
- BleepingComputer: DreamHost forces password resets in ongoing incident, October 26, 2026
- SecurityWeek: Unexplained DreamHost Incident Prompts Email, FTP Password Resets, October 27, 2026
- Help Net Security: DreamHost incident triggers password resets, locks customers out of email and FTP accounts, October 27, 2026