---
id: "CMP-202610-dreamhost-forces-email-and-ftp-sftp-password-resets-in-an-un"
kind: "campaign"
aliases: []
title: "DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DreamHost", "fixed": [], "affected": "email and FTP/SFTP accounts", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-23T00:00:00+00:00"
first_seen_at: "2026-10-26T21:02:57+00:00"
updated_at: "2026-10-26T21:02:57+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-26T21:02:57+00:00"}]
---

# DreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incident

Since 2026-10-23 DreamHost has had an incident that started as File Manager connectivity problems and spread to other services. It blocked logins for email and FTP/SFTP users until account owners set new passwords, and told customers to check every mailbox for unknown forwarding rules, which suggests some mailboxes may have been accessed. DreamHost has not said what happened, how many accounts are affected, or whether files or messages were exposed. Teams hosting sites, mail or FTP on DreamHost are at risk. Cause and attacker are unknown; the incident was still active on 2026-10-26.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DreamHost affected email and FTP/SFTP accounts fixed ?

## How to check

- Check whether any domain, website, mailbox or FTP/SFTP account you run is hosted on DreamHost.
- Review every DreamHost mailbox for forwarding rules or destinations you do not recognise.
- Check whether DreamHost email/FTP passwords were reused elsewhere.

## Fix

- Complete the DreamHost password resets for all mailbox and FTP/SFTP users and tell users out of band (DreamHost cannot contact them directly).
- Remove unknown forwarding rules.
- Change any reused passwords on other services.
- Review site files reachable via FTP/SFTP for unexpected changes (no indicators published).

## Timeline

- 2026-10-26T21:02:57+00:00 analyst

## Documents

- [describes] @BleepinComputer: DreamHost forces password resets in ongoing "incident"
https://t.co/xZhYZq9GL6

 https://x.com/BleepinComputer/status/2114800887314911484
- [describes] BleepingComputer: DreamHost forces password resets in ongoing "incident" https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_