DreamHost has forced password resets for email and FTP/SFTP users following an ongoing incident that initially disrupted access to its File Manager interface. The web hosting provider has instructed affected account owners to follow recovery procedures before users can regain access to their accounts.
According to the company's latest update, recovery instructions have been sent to all affected account owners. Users whose credentials have been reset will remain unable to log in until their account owners establish new passwords.
DreamHost is a U.S.-based web hosting provider and domain registrar offering a range of services, including WordPress hosting, business email, virtual private servers (VPS), dedicated servers and cloud solutions. The company reports serving more than 400,000 customers in over 100 countries, supporting at least 1.5 million websites and applications, including 750,000 WordPress installations.
The incident was first reported on October 23, when customers began experiencing connectivity problems with DreamHost's File Manager interface. The disruption subsequently expanded to affect additional services, prompting the company to restrict access while requiring password resets as a precautionary measure.
Over the following weekend, DreamHost distributed account recovery instructions in batches and notified affected account holders. However, at the time of publication, the incident remained ongoing, with File Manager access still unavailable.
In notifications sent to affected customers, DreamHost also recommended reviewing email forwarding settings and removing any forwarding destinations that users do not recognize. This advice has raised questions about the potential exposure of email accounts, although the company has not publicly provided further details confirming whether unauthorized access occurred or whether customer messages and files were compromised.
The incident has also prompted criticism from some long-time customers over the limited information provided about the disruption. Some users have expressed frustration at the lack of a detailed explanation, leaving customers to speculate about the cause and scope of the incident.
Customers are also advised to change passwords on other platforms if they reused their previous DreamHost credentials elsewhere. Reusing passwords can increase security risks if credentials are compromised.
DreamHost has additionally stated that it cannot contact individual mailbox or FTP users directly. The company has therefore asked account owners to notify affected users through alternative channels, such as phone calls or text messages, because users whose passwords have been reset may be unable to access their email accounts.
BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the incident, the number of affected accounts, and whether customer files or email messages had been exposed. The publication had not received a response at the time its report was published.
As the incident continues, customers are awaiting further information about its cause, the extent of the impact and when normal access to affected services will be restored.
