DreamHost Forces Email Password Resets After Ongoing Incident

If you host a domain's email at DreamHost, some of your mailboxes may have stopped accepting logins over the weekend. DreamHost reset their passwords "as a precaution," sent recovery instructions to account owners in batches, and has still not said what went wrong or how many accounts were touched.

One line in the customer notices matters more than the rest. According to BleepingComputer, DreamHost tells owners to check each email address for forwarding rules and remove any destination they don't recognize. A new password locks an intruder out of the login. It does nothing about a rule they already left behind.

Key Takeaways

• DreamHost first reported File Manager connectivity problems on October 23, 2026, and by that evening was resetting passwords for some email and FTP/SFTP users as a precaution.
• DreamHost's status page said on October 26 that files.dreamhost.com was back online, but that password resets were still required for a subset of email and FTP/SFTP accounts.
• DreamHost has not disclosed the cause, the number of affected accounts, or whether any files or messages were accessed.
• DreamHost's notices tell owners to review every address for forwarding rules and remove unknown destinations, because a forwarding rule keeps copying mail to an attacker after the password changes.
• DreamHost's own help center says its email service does not support multifactor authentication, so the mailbox password is the only lock on each inbox.

What Happened at DreamHost?

DreamHost has confirmed a service incident that knocked its File Manager offline and led to forced password resets, but it has not called it a breach or explained the cause. The DreamHost status page gives the timeline (all times Pacific):

• October 23, 2:20 PM: DreamHost begins investigating connectivity issues with the File Manager interface.
• October 23, 5:20 PM: files.dreamhost.com is offline, some webmail users have been signed out or see login errors, and passwords for some email accounts have been reset as a precaution.
• October 23, 10:13 PM: the issue now covers FTP/SFTP access and webmail. DreamHost warns users not to change passwords yet, since "changes made before our reset is complete will be overwritten."
• October 24, 10:37 AM: resets for affected email and FTP/SFTP users are complete, and owners can set new passwords at panel.dreamhost.com.
• October 25, 9:32 PM: all impacted account holders have been emailed instructions.
• October 26, 3:35 PM: a fix is deployed and File Manager is back, but "Password resets are still required for a subset of email and FTP/SFTP user accounts."

DreamHost also says it cannot contact individual mailbox or FTP users directly. The account owner has to reset each password and pass it on by phone, text or some other channel. BleepingComputer asked DreamHost several times how many accounts were affected and whether files or messages were exposed, and had no answer at publication. The company says it serves more than 400,000 customers, 1.5 million websites and apps, and 750,000 WordPress installs.

Why Does a Forwarding Rule Survive a Password Reset?

A forwarding rule survives because it lives in the mailbox's server side configuration, not in the attacker's session, so changing the password does not touch it. Every new message keeps flowing to the attacker's address until someone deletes the rule. MITRE ATT&CK lists this as technique T1114.003, Email Forwarding Rule, and says such rules let adversaries keep reading a victim's mail "even after compromised credentials are reset by administrators."

The FBI described the same move in Private Industry Notification 20201125-001. It warned that rules created in a webmail client "often do not sync with the desktop client," so the owner never sees them in Outlook or Apple Mail. In one August 2020 case, attackers hid forwarding rules in a medical equipment company's newly upgraded webmail, impersonated an international vendor, and walked away with $175,000. We have seen the pattern since in the Payroll Pirates campaign, where intruders built inbox rules that moved selected messages into Deleted Items and marked them as read, and in our breakdown of what attackers do in the first 10 minutes inside an inbox.

DreamHost has not said that any rule was planted, and the advice may be pure caution. It also means DreamHost is not ruling it out, and checking takes a few minutes per address.

Where Can Forwarding Hide in a DreamHost Account?

At DreamHost, mail can be redirected from at least three places, and an owner checking only webmail will miss most of them:

• Forward only addresses in the panel. On the Manage Email page, a forward only address can send everything to up to 10 destinations. Click Manage next to each address and read every destination listed.
• Message Filters. Filters can be created on the panel's Message Filters page or by the mailbox user at mailboxes.dreamhost.com, according to DreamHost's filter setup guide. Look for any filter you did not write, especially ones that "Delete it" (which bypasses Trash) or "Forward to shell account."
• Shell users' forward files. DreamHost's filter field reference explains that "Forward to shell account" hands mail to a shell user, whose .forward.postfix file then decides what happens to it. Since SFTP logins were also reset in this incident, check that file in each shell user's home directory.

Then check the clients. DreamHost's webmail runs on Roundcube (its help screenshots carry the Roundcube name), and the rules in desktop and phone mail apps are separate from the server's. If you also run Roundcube elsewhere, our coverage of the exploited Roundcube SQL injection CVE-2026-48842 covers what to patch.

Has DreamHost Reset Passwords Like This Before?

Yes. In January 2012 DreamHost reset FTP and shell passwords for all of its customers after one of its database servers was "illegally accessed using an exploit," Computerworld reported. DreamHost said then that billing and personal data were not exposed, and it claimed over 300,000 customers.

Two things are different in 2026. The customer base is larger, at more than 400,000. And email passwords are in scope this time, not just FTP and shell. In 2012 a stolen FTP password could deface a website. A stolen mailbox password can read invoices, intercept password reset links and quietly forward both.

Why Email Users Should Care

DreamHost mailboxes have no second factor. The DreamHost Multifactor Authentication overview states it plainly: "DreamHost email service does not support Multifactor Authentication (MFA)." MFA protects the panel login only. For a small business whose invoices, client contracts and bank alerts arrive at a DreamHost address, the mailbox password is the whole defense, and that is exactly the setup business email compromise crews look for. The Dover airmen BEC case showed how mailbox monitoring tells fraudsters when a payment is due.

Many DreamHost users read that mail in Gmail. If Gmail fetches your DreamHost mailbox over POP, or sends as your domain through DreamHost's SMTP server, Gmail stores the old password and will start failing until you update it under Settings, then Accounts and Import. Google says Gmailify and POP fetching are being phased out, with existing users able to keep the feature until January 2027, so this reset is a good moment to decide how your domain mail reaches Gmail at all.

Expect phishing too. DreamHost has just emailed reset instructions to every affected owner, and that makes a fake "reset your DreamHost email password" message very easy to pass off as real.

What Should DreamHost Customers Do Now?

Work through this list once, as the account owner, from a browser you typed the address into:

1. Reset every flagged mailbox and FTP/SFTP user in the panel. Go to panel.dreamhost.com directly, never via a link in an email. On Manage Email, click Manage next to each address and use Change Password. DreamHost's mail password guide notes that "It is not possible to update the password within Webmail."
2. Audit forwarding and filters for every address, including ones that were not flagged: forward only destinations, Message Filters in the panel and at mailboxes.dreamhost.com, and .forward.postfix files for shell users. Delete anything you cannot explain.
3. Check autoresponders. The mailboxes interface lets users create them, and an unexpected one is a sign someone else has been in the account.
4. Hand new passwords over out of band. DreamHost cannot reach mailbox users, so call or text them. Do not email a new password to the address you just reset.
5. Kill password reuse. If the old DreamHost password was used anywhere else, change it there too, starting with banking and Gmail.
6. Update every stored copy of the password: phone and desktop mail apps, Gmail's Accounts and Import settings, and any WordPress plugin or script that sends mail through DreamHost SMTP.
7. Turn on MFA for the DreamHost panel. Mailboxes cannot have it, but the panel, where forwarding destinations are set, can.

What DreamHost Still Has Not Said

The open questions are the important ones: what caused the incident, how many mailboxes and FTP users were reset, whether anyone read stored mail or files, and why the notices single out forwarding rules. Until DreamHost answers on its status page, treat every DreamHost mailbox as possibly exposed and check its forwarding yourself. A reset you did not finish auditing is only half a reset.