DreamHost Expires Some Email, FTP and SFTP Passwords After an Incident. What Account Owners Should Do Now

TL;DR: DreamHost, the US web host, has been dealing with an incident since October 23, 2026 (US Pacific time). As a precaution it expired the passwords of some email, FTP and SFTP user accounts, and those users can’t sign in until the account owner sets new passwords in the DreamHost panel. DreamHost hasn’t said what happened or whether any data was accessed, but it tells owners to check every mailbox for forwarding rules they don’t recognize. The File Manager came back online on October 26. If you host email or sites on DreamHost, reset the affected passwords now, check the forwards, and give your users the new passwords by phone or text.

What happened

DreamHost’s status page lists an active incident titled “Investigating an incident affecting File Manager and Webmail.” The timeline, from DreamHost’s posts (Pacific time, with Manila time in brackets):

• October 23, 2:20 p.m. PDT (Oct 24, 5:20 a.m. Manila): DreamHost reported connectivity problems with its File Manager.
• October 23, 5:20 p.m. PDT (Oct 24, 8:20 a.m. Manila): DreamHost said it was investigating an incident affecting several services. The File Manager at files.dreamhost.com went offline, some webmail users were signed out, and it began resetting the passwords of some email accounts “as a precaution.”
• October 23, 10:13 p.m. PDT (Oct 24, 1:13 p.m. Manila): The issue now included FTP/SFTP access and webmail, and the resets covered some FTP/SFTP users too. DreamHost asked customers to wait for its email before changing passwords, because earlier changes would be overwritten.
• October 24, 10:37 a.m. PDT (Oct 25, 1:37 a.m. Manila): DreamHost said the password reset was complete and owners could set new passwords right away without waiting for the email.
• October 25, 9:32 p.m. PDT (Oct 26, 12:32 p.m. Manila): All affected account holders had been emailed step-by-step instructions.
• October 26, 3:35 p.m. PDT (Oct 27, 6:35 a.m. Manila): A fix was pushed to the File Manager, which is back online, and DreamHost is monitoring it. Password resets are “still required for a subset of email and FTP/SFTP user accounts.”

DreamHost’s knowledge base notice says the passwords “were recently expired” “to ensure the continued integrity of DreamHost customer accounts.” Mail keeps arriving in the affected mailboxes and FTP/SFTP files stay on the server, but users can’t log in until the owner sets a new password. DreamHost hasn’t said what caused the incident, how many accounts were affected, or whether anyone accessed mail or files.

Why it matters

Plenty of small businesses, freelancers and agencies run their company email and client websites on shared hosts like DreamHost. When a host resets passwords this way, it lands on the account owner: you have to set new passwords for every affected mailbox and FTP user, update every phone and mail app, and get the new passwords to staff or clients who can’t read their email.

The forwarding advice is the part to take seriously. A forwarding rule quietly copies incoming mail to another address, so a rule you didn’t set up can leak invoices, password-reset links and client messages long after a password change. DreamHost doesn’t say any rules were added, but it asks every owner to check. Password-reset notices are also a favorite phishing lure, so expect fake “DreamHost” emails. This is the same pattern we covered when Railway told developers to rotate secrets: the provider fixes its side, and each customer has to clean up its own. Our Security hub tracks other incidents like this one.

What to do now

1. Go to the panel directly. Type panel.dreamhost.com into your browser rather than clicking a link in an email. DreamHost says it “will never email you asking for your password” and its notification “will not ask you to log in through a link.”
2. Reset mail passwords. Under Mail > Manage Email, set a new, unique password for each address DreamHost reset. You don’t need to wait for DreamHost’s email. If you use Professional Email and saw a “Failed to edit” error, DreamHost says that’s fixed, so try again.
3. Check every forward. On the same page, review the forwarding settings on each address and remove any forward you don’t recognize or no longer use. DreamHost recommends this.
4. Reset FTP/SFTP passwords. Under Websites > SFTP Users & Files, set new passwords for each FTP/SFTP user. DreamHost says changes can take up to 15 minutes to take effect.
5. Update saved passwords. Mail apps on phones and laptops, FTP/SFTP clients, deploy scripts and backup tools that store these passwords will fail until you update them.
6. Tell your users another way. DreamHost says affected mail and FTP users can’t log in until the account owner resets their passwords and shares the new ones. It recommends reaching each user by phone, secure text or another private channel, not their DreamHost mailbox, which they can’t open yet.
7. Change reused passwords elsewhere. If an old DreamHost password was used on any other service, change it there too. This is our advice.
8. Look for other signs of tampering. Check for mail filters or auto-replies you didn’t create, and for unexpected file changes on your sites since October 23. DreamHost hasn’t asked for this; it’s our advice while the cause is unknown.

Updates

• Oct 27, 2026, 4:14 p.m. Manila: First published. DreamHost’s latest status update at our check was October 26, 3:35 p.m. PDT. We’ll add a dated note here if DreamHost explains the cause or says whether data was accessed.

Sources & method

Sources

• DreamHost status page, “Investigating an incident affecting File Manager and Webmail,” updates October 23 to 26, 2026
• DreamHost status page RSS feed (update times)
• DreamHost Knowledge Base, “Current Status Notifications: October 25, 2026: Password Resets Required”
• DreamHost Knowledge Base, “Change password (Mail users)”

Method. Last checked October 27, 2026, at 4:13 p.m. Manila time (08:13 UTC). The timeline and quotes come from DreamHost’s status page, whose times are in US Pacific time (PDT); the steps for mail and FTP/SFTP users, the forwarding advice and the advice to contact users by phone or text come from DreamHost’s knowledge base notice. Steps 7 and 8 under “What to do now” are our own advice. No affiliate links on this page. How we work.