DreamHost restored its browser-based File Manager on October 26, yet some email and FTP/SFTP users remain locked out pending new passwords. The hosting provider still hasn’t explained what triggered the precautionary resets.
Key Facts
- DreamHost first flagged File Manager connection problems at 2:20 p.m. PDT on October 23, then added webmail and FTP/SFTP access.
- Account owners must set new passwords for affected mailbox and FTP/SFTP users in the DreamHost panel and share them privately.
- DreamHost says locked mailboxes keep receiving mail, and FTP/SFTP user files stay stored on the server.
- The company hasn’t disclosed a root cause or how many email and FTP accounts it reset.
What Happened?
The trouble began on Friday afternoon, when DreamHost’s operations team reported connectivity problems with the File Manager at files.dreamhost.com. By that night, the company’s status page said some webmail users had been signed out. It also said DreamHost was resetting passwords for some email and FTP/SFTP users as a precaution.
Those first notices told owners to wait for an email before touching anything, since changes made before the reset finished would be overwritten. DreamHost dropped that instruction at 10:37 a.m. PDT the next morning, when it declared the reset complete and told owners to act right away.
🚨 DreamHost forces email and FTP/SFTP password resets during ongoing incident DreamHost has expired passwords for some email and FTP/SFTP users following an incident affecting its webmail and File Manager services. ⠀ The company says all impacted account owners have now been emailed instructions. Affected users will remain unable to access their email or files until the account owner creates new passwords and shares the credentials with them. ⠀ DreamHost has not disclosed the cause of the incident, whether any data was accessed or how many customers were affected. Its browser-based File Manager also remains unavailable as restoration work continues. ⠀ Account owners should go directly to https://t.co/s3oAepCljS and reset credentials under: • Mail > Manage Email • Websites > SFTP Users & Files DreamHost warns that it will never request passwords by email or direct customers to sign in through an emailed link.
— Dark Web Informer (@DarkWebInformer) October 26, 2026
Monday’s fix covered the File Manager only
Engineers pushed a fix for the File Manager on Monday afternoon and moved the incident to monitoring at 3:35 p.m. PDT. The same update carried a caveat for everyone else: “Password resets are still required for a subset of email and FTP/SFTP user accounts.“
The status page still lists the File Manager interface, email hosting and webmail as disrupted. Web hosting, DreamPress and the DreamHost panel show as operational. In practice, websites stayed up while some of the people running them were locked out of mail and file transfers.
Owners hold the only keys to locked mailboxes
Only the DreamHost account owner, or a privileged panel user, can set the new passwords. Mailbox users can’t change them from webmail. In a private notice to owners that later surfaced on Reddit, DreamHost said it couldn’t contact individual mailbox or FTP users directly. Many of those users won’t know about the reset until someone tells them.
DreamHost’s knowledge base advisory lays out the cleanup, and its steps help reduce risk from stale or reused credentials:
- Open the panel by typing panel.dreamhost.com directly, since DreamHost says its notices never ask anyone to log in through a link.
- Set new mailbox passwords under Mail > Manage Email and new FTP/SFTP passwords under Websites > SFTP Users & Files.
- Review the forwarding settings on every address and delete any forward you don’t recognize or no longer use.
- Update saved passwords in mail apps and FTP clients, and change the old password anywhere else it was reused.
- Send new credentials by phone or secure text, not to the DreamHost inbox the user can’t open yet.
The advisory says changed passwords can take up to 15 minutes, though its FTP/SFTP step says to allow up to five. Testing too early can look like a failed reset.
The incident stays open on DreamHost’s status page, and the company says it will post again once the File Manager is fully operational. Until then, recovery for locked users runs through account owners. A reset mailbox keeps collecting mail, but nobody can read it until an owner sets and shares a new password.
