Infrastructure, domains & the recurring invoice of civilisation

The Hosting Times

Independent reporting on web hosting, domains and the infrastructure behind the internet.

Security

DreamHost Password Resets Still Needed for Some Mail and File-Transfer Users

October 27, 2026 ·
Illustrated mail and file-transfer account cards with refresh symbols for required password changes

Original editorial illustration by The Hosting Times. Symbolic mail and file-transfer accounts; not a DreamHost interface or incident screenshot.

DreamHost says some customers must set new passwords for mail and FTP/SFTP users after an incident disrupted webmail and its file manager. If you own an affected account, open the DreamHost panel directly, replace those passwords, and give users their new sign-in details through a private channel. The company has not publicly identified the cause or said that every customer account was compromised.

What happened?

DreamHost began investigating file-manager access problems on October 23. It later reported webmail sign-in problems and expired passwords for some mail and file-transfer accounts as a precaution. FTP and SFTP are ways to move website files to a hosting account. The company’s incident timeline says it emailed all impacted account holders by October 25.

In an October 26 update, DreamHost said its file manager was back online and being monitored. Password resets remained necessary for a subset of accounts. Its customer notice says affected mailboxes continue receiving messages and FTP/SFTP users’ data remains on the server. It does not explain what caused the incident or establish that customer data was taken.

What should affected customers do?

  1. Go straight to the panel. Type panel.dreamhost.com yourself. DreamHost says its notification will not ask for your password or send you to a login link.
  2. Set new passwords. Account owners can use Mail → Manage Email for mail users and Websites → SFTP Users & Files for file-transfer users. Use a different strong password for each account. DreamHost says changes may take up to 15 minutes to work.
  3. Reconnect users and apps. Update saved passwords in email apps and FTP/SFTP clients. Contact employees, clients or family members who use these logins by phone, secure text or another private method—not by an affected DreamHost mailbox that they cannot yet open.
  4. Check forwarding and access. DreamHost advises reviewing mail-forwarding settings and removing forwards you do not recognize or need. Test mail and file access after the reset. If access still fails, contact DreamHost support through the panel.

If you only use a DreamHost mailbox or file-transfer login but do not own the hosting account, ask the account owner for help. DreamHost’s notice says the owner must set the new password before affected users can sign in. Check the live status page for later updates; a service marked as monitored is not the same as a final incident report.