DreamHost Password Resets: Check Mail Forwarding Too

DreamHost's 26 October update, posted at 3:35pm PDT, says its File Manager is back online following a fix and remains under monitoring. Password resets are still required for a subset of email and FTP/SFTP accounts. That is a recovery update, not an all-clear for every affected login.

The incident began with File Manager connectivity reports on 23 October. DreamHost subsequently expired some user passwords as a precaution. Its knowledge-base notice says mailboxes continue receiving messages and FTP/SFTP data remains stored on the server while users cannot sign in. Those availability statements do not establish that nobody accessed the data.

Open panel.dreamhost.com directly using your usual bookmark or by typing the address. For affected email accounts, use Mail > Manage Email; for FTP/SFTP users, use Websites > SFTP Users & Files. Set strong, unique passwords and allow up to 15 minutes for a change to take effect. DreamHost says you do not need to wait for its notification email to do this.

While reviewing each email address, inspect its forwarding settings. DreamHost specifically advises removing forwarding destinations you do not recognise or no longer use. A password change and a forwarding-rule check do different jobs: a mailbox can regain access while an unwanted rule still sends future mail elsewhere. The advice is not proof that every affected mailbox had such a rule.

Update saved credentials in email and file-transfer apps, then contact the people who use those accounts through a separate, private channel. Do not send their only recovery instructions to the inbox they currently cannot open. Verify the recipient before sharing replacement credentials and avoid group messages.

Contact the person or organisation that manages your DreamHost hosting account. The required change is made by that account owner; repeatedly retrying the old password in your mail app will not restore access. Once you receive the replacement securely, update the saved password on each device that uses the account.

Treat unexpected recovery messages cautiously. DreamHost says it will never email asking for your password. Use the official panel and support routes rather than a login link or phone number in an unsolicited message. If you reused the old password on another service, replace that copy with a unique one through that service's official site. This is a precaution, not a finding that the old password was stolen.

The DreamHost notices reviewed for this article describe the disruption, precautionary resets and recovery steps. They do not establish an attacker, the number of affected people, or whether email messages or hosted files were taken. Do not confuse the provider's overall customer base with the affected subset.

Check the linked incident timeline for later updates. If you find an unfamiliar forwarding destination or other unexpected account activity, contact DreamHost through its official support route and retain the relevant details for investigation.

A VPN encrypts traffic between your device and the VPN server. It cannot reset a hosted mailbox password, remove a forwarding rule or resolve an incident inside a hosting provider. Account-owner recovery, unique credentials and checking settings address this problem; changing your public IP address does not.