DreamHost resets email and SFTP passwords after a webmail incident

DreamHost resets email and SFTP passwords after a webmail incident

24 October 2026: DreamHost has reset the passwords of some email and FTP/SFTP users "as a precaution" during an incident that took its panel File Manager offline and signed some webmail users out. The reset is now complete, so a business hosted there may find that Outlook, Apple Mail, a phone or a deployment script has stopped accepting the old password until the account owner sets a new one.

Not yet independently verified. This rests on DreamHost's own status page, read on 25 October while the incident was still open; DreamHost has not said what caused it, how many users were reset, or whether any data was accessed. We will update this when it can be confirmed, and remove this note.

The status page still lists the incident as "Identified" rather than resolved. File Manager, email hosting and webmail were marked as disrupted in the latest update, while web hosting, VPS and dedicated servers, databases, phpMyAdmin, domain registrations and certificates were shown as operational.

How the incident unfolded

The first post, at 2:20 pm Pacific on 23 October, described connectivity problems with the File Manager interface. Three hours later DreamHost said it was investigating an incident affecting several services: the File Manager at files.dreamhost.com was offline, some webmail users had been signed out or saw an error when logging in, and the passwords of some email accounts were being reset. At 10:13 pm the scope widened to FTP/SFTP access, and customers were asked to wait for DreamHost's email before changing anything, because changes made before the reset finished "will be overwritten".

That advice reversed the next morning. At 10:37 am on 24 October DreamHost said the reset of affected email and FTP/SFTP users was complete and owners could set new passwords at once, without waiting for the email. Its 6:09 pm update said the emails with step-by-step instructions had begun going out in batches over several hours.

Setting new passwords, and the phishing risk

Only the account owner can set the new password. The status page points to two places in panel.dreamhost.com:

• Mail > Manage Email for mailbox passwords
• Websites > SFTP Users & Files for FTP and SFTP users

A new password can take up to 15 minutes to work. Users who are not the account owner, such as staff with a mailbox or a contractor with SFTP access, have to ask the owner. Anything that signs in with a stored password needs the new one too: mail clients on every device, backup jobs, and deployment tools that push files over SFTP.

DreamHost repeats in every update that it will never email asking for a password and that its notice will not ask anyone to log in through a link. A mass reset is a gift to phishers, since many customers are expecting exactly such an email this week, so the safe route is to type panel.dreamhost.com into the browser and ignore any reset email that was not requested.

What DreamHost has not said

The updates give no cause, no count of affected users and no statement on whether any mailbox or file was read. A precautionary reset of mail and SFTP credentials while the File Manager stays offline points to a concern about credentials rather than a plain outage, but DreamHost has not said so. The company says it has hosted websites since 1997 and has more than 400,000 customers in over 100 countries.

Our web hosting category lists 200 companies. The next thing to watch is whether DreamHost closes the incident with an explanation, and whether it says any customer data was exposed.

Company profile on TrustList: DreamHost

Sources

• DreamHost Status: Investigating an incident affecting File Manager and Webmail (updates of 23 and 24 October), 24 October 2026
• DreamHost: About our company (read 2026-10-25), 25 October 2026