{"id":"CMP-202610-dreamhost-forces-email-and-ftp-sftp-password-resets-in-an-un","kind":"campaign","aliases":[],"related":[],"title":"DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident","description":null,"summary":"Since 2026-10-23 DreamHost has had an incident that started as File Manager connectivity problems and spread to other services. It blocked logins for email and FTP/SFTP users until account owners set new passwords, and told customers to check every mailbox for unknown forwarding rules, which suggests some mailboxes may have been accessed. DreamHost has not said what happened, how many accounts are affected, or whether files or messages were exposed. Teams hosting sites, mail or FTP on DreamHost are at risk. Cause and attacker are unknown; the incident was still active on 2026-10-26.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DreamHost","fixed":[],"affected":"email and FTP/SFTP accounts","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Check whether any domain, website, mailbox or FTP/SFTP account you run is hosted on DreamHost.\n- Review every DreamHost mailbox for forwarding rules or destinations you do not recognise.\n- Check whether DreamHost email/FTP passwords were reused elsewhere.","fix":"- Complete the DreamHost password resets for all mailbox and FTP/SFTP users and tell users out of band (DreamHost cannot contact them directly).\n- Remove unknown forwarding rules.\n- Change any reused passwords on other services.\n- Review site files reachable via FTP/SFTP for unexpected changes (no indicators published).","status":"open","published_at":"2026-10-23T00:00:00+00:00","first_seen_at":"2026-10-26T21:02:57+00:00","triaged_at":"2026-10-26T21:02:57+00:00","updated_at":"2026-10-26T21:02:57+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':34B,127B '-202610':14A '-23':35B '-26':128B '2026':33B,126B 'access':85B 'account':62B,94B 'activ':124B 'affect':96B 'an':25A 'and':19A 'attack':117B 'block':54B 'campaign':28B 'caus':115B 'check':71B 'cmp':13A 'connect':46B 'custom':69B 'dreamhost':1A,16A,27A,36B,86B,111B 'dreamhost-forces-email-and-ftp-sftp-password-resets-in-an-un':15A 'earli':30B 'early-warn':29B 'email':3A,18A,57B 'everi':72B 'expos':103B 'file':44B,99B 'forc':2A 'forces':17A 'forward':76B 'ftp':20A,109B 'ftp/sftp':5A,59B 'happen':91B 'host':105B 'in':24A 'incid':12A,40B,121B 'login':55B 'mail':107B 'mailbox':73B,81B 'manag':45B 'mani':93B 'may':82B 'messag':101B 'new':65B 'ongo':11A 'owner':63B 'password':6A,22A,66B 'problem':47B 'reset':7A 'resets':23A 'risk':114B 'rule':77B 'said':89B 'servic':52B 'set':64B 'sftp':21A 'sinc':32B 'site':106B 'spread':49B 'start':42B 'still':123B 'suggest':79B 'team':104B 'told':68B 'un':26A 'unexplain':10A 'unknown':75B,119B 'user':60B 'warn':31B 'whether':98B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-dreamhost-forces-email-and-ftp-sftp-password-resets-in-an-un","url":null,"severity":null,"published_at":"2026-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-26T21:02:57+00:00","fetched_at":"2026-10-26T21:02:57+00:00","note":null}],"documents":[{"id":4049,"url":"https://x.com/BleepinComputer/status/2114800887314911484","title":"@BleepinComputer: DreamHost forces password resets in ongoing \"incident\"\nhttps://t.co/xZhYZq9GL6\n\n","kind":"post","source":"x","text":"DreamHost forces password resets in ongoing \"incident\"\nhttps://t.co/xZhYZq9GL6\n\nhttps://t.co/xZhYZq9GL6\n\nlikes 2 reposts 0","published_at":"2026-10-26T19:26:37+00:00","relation":"describes","confidence":null,"note":null},{"id":4350,"url":"https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/","title":"BleepingComputer: DreamHost forces password resets in ongoing \"incident\"","kind":"blog","source":"blog","text":"DreamHost forces password resets in ongoing \"incident\"\n\nDreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]","published_at":"2026-10-26T19:26:20+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}