DreamHost has expired passwords for affected email and FTP/SFTP users during an unresolved incident. The hosting account owner must set replacement passwords and get them to those users. Waiting for a mailbox user to recover access independently can leave them locked out.

Bill Toulas’s October 26 report adds a second task: review email forwarding rules. He reports that DreamHost’s customer notification tells owners to remove forwarding destinations they do not recognize.

The reset is confirmed; the cause remains undisclosed

DreamHost’s incident timeline began with File Manager connectivity problems on October 23. Later updates described disrupted webmail and precautionary resets for some mail and FTP/SFTP users.

The October 25 at 21:32 PDT entry says all impacted account holders have received instructions. Affected users cannot log in until their account owner sets and shares new credentials. DreamHost subsequently restored File Manager on October 26; the update below records that change.

Evidence status: vendor-confirmed disruption and credential resets, with data exposure unresolved. Neither the reviewed timeline nor Toulas’s reporting identifies a confirmed entry point, victim count or stolen-data inventory. Checking forwarding rules is prudent; that instruction alone does not prove an attacker read every affected mailbox.

DreamHost’s total customer and website counts describe its business, not the number affected by this incident.

Recover access through the account owner

DreamHost’s current instructions supersede its earlier request to wait for an email before changing passwords:

  • Open the DreamHost control panel directly. Use panel.dreamhost.com, rather than a login link in a reset message. DreamHost says it will never email asking for a password.
  • Set new passwords for affected users. The status page names Mail > Manage Email and Websites > SFTP Users & Files. Allow up to 15 minutes for a replacement to take effect.
  • Contact users through another channel. Their affected mailbox may be unavailable. Arrange a trusted way to provide replacement credentials, then update their mail applications and file-transfer clients.
  • Review forwarding destinations. Remove unrecognized rules, following the customer guidance reported by BleepingComputer. Replacing a password leaves an unwanted forwarding rule unresolved.
  • Replace reused passwords elsewhere. Use distinct replacements for other services that shared the old password, as the reported notification recommends.

DreamHost says it fixed the “Failed to edit” error some Professional Email customers encountered during resets. Owners who saw that error should try again. Its mail-password documentation confirms that recovery requires panel access or the account owner’s assistance; Webmail itself cannot change the password.

This is a hosted-service incident. The reviewed sources specify account recovery actions, with no customer-installed software version identified as a fix.

What the thread adds

In the Hacker News discussion, xmddmx reports receiving notices at different times across multiple accounts. The commenter also says some supposedly expired passwords still worked. dannyw replies that bulk-email delivery limits can complicate notification timing.

Those are a customer self-report and a proposed explanation, respectively. They support checking each owned account’s instructions and recovery state rather than assuming one notice covers everything.

The leading comment from duskwuff begins “Reading the tea leaves” and speculates about a PHP-related entry point. Replies dispute that interpretation. DreamHost’s reviewed notice confirms no such link, so the PHP theory remains unverified.

From a 68-comment thread, in HN’s own order.

Caveat: DreamHost has not explained whether messages or files were accessed; BleepingComputer says its questions remained unanswered at publication. A completed password reset establishes restored credentials, not a completed investigation.

Update: October 26, 21:45 EDT — File Manager restored; password resets still required

DreamHost’s October 26 status entry at 15:35 PDT says engineers deployed a fix and File Manager is back online. The provider has moved to monitoring while it checks that the service remains fully operational.

This supersedes the earlier statement that File Manager restoration was still in progress. Password resets remain required for a subset of email and FTP/SFTP accounts. Owners should complete those resets and the forwarding review even if file access works again. The status update supplies no new root-cause or data-exposure finding.