DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface.
The latest update from the web hosting provider notes that all affected account owners have received recovery instructions. Users will be unable to log in until their account owner sets new credentials.
DreamHost is a U.S. web hosting provider and domain registrar that offers WordPress hosting, business email, virtual private servers, dedicated servers, and cloud services.
According to the company page, it serves over 400,000 customers in more than 100 countries and supports at least 1.5 million websites and applications, including 750,000 WordPress installations.
DreamHost initially reported connectivity problems affecting its File Manager interface on October 23, but the impact quickly expanded to other services.
The company responded by blocking access to all users until they completed password resets, an action described as a precaution.
Over the weekend, the company sent out recovery instructions in batches and notified all affected account holders.
As of publishing, the incident remains active and access to File Manager is still unavailable.
In notifications to impacted account holders, the company advises users to also review each email address for forwarding rules and remove any forwarding destination they do not recognize.
While this suggests that some email accounts may have been breached and exposed to external actors, DreamHost did not provide additional details.
Long-time customers are also complaining about the lack of information from DreamHost, leading some of them to speculate about what happened.
"It's disturbing to get these emails with zero explanation what's going on, and very frustrating that user community has to guess," one customer said.
Users are also recommended to change reused passwords elsewhere if their old DreamHost password was reused on other platforms/services.
DreamHost also said it cannot contact individual mailbox or FTP users directly, urging account owners to notify affected users by phone, text, or other means, as those whose passwords were reset may be unable to access their email accounts.
BleepingComputer has contacted DreamHost multiple times with questions about the incident, the number of impacted accounts, and whether files or messages were exposed, but we have not heard back as of publication.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.