DreamHost spent the weekend resetting passwords for a subset of its email and FTP/SFTP users and has still not explained what prompted it. The web host first reported trouble with the File Manager on the afternoon of October 23, then widened the incident to webmail and later to FTP access.
Customers were told to wait. Any password they changed themselves before the company completed its own reset would be overwritten, DreamHost said, and the resets finished on October 24. Because the company has no way to reach individual mailbox or FTP users, account owners have to set new credentials and pass them on before those people can sign in again.
Restored, still unexplained
Files.dreamhost.com is back after engineers deployed a fix. Webmail, email hosting and the File Manager remained listed as disrupted on the status page, while the rest of the estate is marked operational. DreamHost has not described the root cause or said how many customers are affected, and SecurityWeek reported that it asked and received no answer by publication.
Users on Reddit reacted badly to the notification itself, describing a message that announced a reset without stating what happened, and wondering whether stored passwords had been adequately hashed. Some said they learned nothing through their backup address at all.
For teams sitting on this kind of dependency
The case is an argument for treating hosting-provider mailboxes as internet-facing identity. Credentials reused from an FTP account into anything else should be rotated now, not after a provider confirms a breach. Administrators should also make sure the account owner’s contact address is somewhere other than the mailbox being reset, because a reset loop on the primary address leaves nobody able to act.
