DreamHost Forces Password Resets Following Web Hosting Incident

American web hosting provider DreamHost has forced password resets across user email and file transfer protocol accounts following an active security incident that disrupted its File Manager interface.

The provider initially identified connectivity problems affecting its File Manager interface on 23 October 2026, but the scope of the disruption quickly expanded. In response, DreamHost blocked access to affected accounts until primary account owners completed credential recovery procedures.

In communications distributed to account holders over the weekend, the company advised administrators to review all individual email addresses for unauthorised forwarding rules and to remove any unfamiliar destination addresses immediately.

Customer Impact and Management Guidance

DreamHost warned that account owners must directly inform individual mailbox and FTP users of the forced resets via telephone or text message, as end-users locked out of their accounts cannot access incoming email notifications.

The company also urged customers to update credentials on external services if they had reused their DreamHost account passwords elsewhere, mitigating potential secondary credential-stuffing risks.

As of publication, access to the File Manager interface remains offline as containment and recovery measures continue. Customer frustration has grown over the limited technical details released regarding whether files or stored messages were accessed during the intrusion.

Based in the United States, DreamHost manages infrastructure for more than 400,000 customers internationally and supports approximately 1.5 million websites and online applications, including over 750,000 WordPress installations.