DreamHost, the web hosting provider and domain registrar, blocked some customers from logging in to email and FTP or SFTP accounts on Oct. 23, 2026, and kept them out until the account owner set new credentials. The company called the resets a precaution while it dealt with an incident that began as a connectivity problem with its File Manager tool. As of Oct. 26 the company had not said what caused the incident or how many accounts it touched.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The episode is a useful case of a hosting company acting first and explaining later. Account holders found themselves unable to open mailboxes or upload files, and the company’s own notices, relayed by the press, left open whether any messages or files were exposed. Nothing published so far establishes a breach, and the status posts do not describe one.
From a File Manager outage to forced resets
DreamHost’s own status page logs the sequence. The first post, at 2:20 p.m. Pacific time on Oct. 23, reported connectivity issues with the File Manager interface, and a later post that afternoon said the File Manager was offline and that some webmail users had been signed out. At 10:13 p.m. the company wrote that it had identified an issue affecting FTP and SFTP access and webmail, and that, as a precaution, the company was resetting passwords for some email and FTP or SFTP users, according to the DreamHost status page. The incident was titled as an investigation of File Manager and Webmail.
BleepingComputer, which reported on the incident on Oct. 26, described the affected users as unable to log in until their account owner sets new credentials. Its reporter, Bill Toulas, wrote that DreamHost sent recovery instructions in batches over the weekend and notified affected account holders, and that the company said it cannot contact individual mailbox or FTP users directly.
That last point shaped the cleanup. DreamHost asked account owners to tell their own users, by phone, text or another channel, that the passwords had been reset, because a person whose password was changed may no longer be able to read the email that would explain why. For a small business with several mailboxes on one hosting plan, the owner became the only route to everyone else.
What DreamHost has and has not said
The status posts move from investigating to identified on Oct. 23 and stay there for days. On Oct. 24 at 12:25 a.m. Pacific time, resets were still running overnight and users were asked to wait for the instruction email before changing a password themselves. Later that morning the company said the reset itself was complete while emails were still going out, and on the evening of Oct. 24 it said account owners could set new passwords in the control panel without waiting for a message. On Oct. 25 it added that most reset emails had gone out and that a “Failed to edit” error affecting Professional Email customers had been fixed.
On Oct. 26, at 3:35 p.m. Pacific time, the company reported that engineers had pushed a fix to the File Manager, that the tool was back online and being monitored, and that password resets were still required for some email and FTP or SFTP accounts. The status page does not describe the cause.
BleepingComputer contacted the company several times about the number of accounts affected and whether files or messages were exposed, and had no answer when it published. It also noted that the company’s notices advise reviewing each email address for forwarding rules and removing any destination the owner does not recognize, and the report reads that advice as a sign that some email accounts may have been breached. DreamHost serves more than 400,000 customers in over 100 countries and at least 1.5 million sites, so the unknown is the share of those customers that were affected, not the company’s size.
A precedent and what account owners can check
DreamHost has forced resets before. In January 2012, according to PCWorld’s report at the time, it reset FTP and shell passwords for customers after an unauthorized party reached one of its database servers, and its chief executive, Simon Anderson, said the exploit had not been known or blocked by the company’s layered defenses. That incident involved a confirmed intrusion and a stated cause. The current one has neither, which leaves customers with less to go on than the 2012 customers had.
The FTC’s guidance gives owners a few concrete checks while the questions stay open. Its advice on recovering a hacked email account starts with checking email settings for rules that forward messages to another address, and it recommends a strong new password and two-factor authentication. Because reset instructions are what customers are waiting for, the agency’s phishing guidance matters too: it says to contact a company using a phone number or website known to be real, “not the information in the email.”
DreamHost has said it will never email customers asking for a password, and that reset messages nobody requested can be ignored. BleepingComputer’s account of the notices also tells owners who reused the old DreamHost password on another service to change it there as well. The open items for the company are the cause, the number of accounts and whether any content was read, none of which had been answered by the end of Oct. 26.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
