# DreamHost Forces Email and FTP/SFTP Password Resets Following Undisclosed Security Incident (Oct 2026)

> DreamHost forced precautionary password resets for email (including Professional Email) and FTP/SFTP accounts after an incident beginning 2026-10-23 disrupted File Manager and webmail. The root cause, scope and any data theft have not been disclosed.

- **Published:** 2026-10-27T08:46:03Z
- **Last reviewed:** 2026-10-27T08:46:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4524
- **ID:** TL-2026-4524
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-23 at 2:20 PM PDT, DreamHost began investigating File Manager connectivity issues. By 5:20 PM PDT the scope had expanded: File Manager was offline and webmail users saw logouts and errors. DreamHost stated, 'As a precaution, we are resetting the passwords of some email accounts.' At 10:13 PM PDT the incident was identified as password resets underway for email and FTP/SFTP users, and customers were told to wait for DreamHost's reset email before changing passwords themselves.

Resets finished at 10:37 AM PDT on 2026-10-24, and account owners could then set new credentials through the panel. Batch notification emails began at 6:09 PM PDT on 10-24. By 11:43 AM PDT on 10-25 most emails had been delivered, and distribution was complete at 9:32 PM PDT. File Manager was restored at 3:35 PM PDT on 2026-10-26, with monitoring continuing and password resets still required for a subset of email and FTP/SFTP accounts. DreamHost says affected mailboxes continue to receive mail even when users cannot access them. New credentials were delivered by phone call or secure text because the affected mailbox may be inaccessible.

Customer guidance: log in directly at panel.dreamhost.com (never via emailed links; DreamHost says it will never request passwords by email); reset mailbox passwords under Mail > Manage Email and SFTP credentials under Websites > SFTP Users & Files; allow up to 15 minutes for a new password to take effect; update saved credentials in mail and FTP/SFTP clients; and check mailbox forwarding settings for unfamiliar entries.

Evidence limits: the available DreamHost notices and the secondary news report (Cyber Security News, 2026-10-27) identify no attacker, malware, entry point, vulnerability/CVE or confirmed data theft. There are no attributable IOCs. DreamHost calls the resets precautionary, and it has not confirmed unauthorized access. The advice to check forwarding rules suggests mailbox-forwarding abuse is a risk DreamHost wants customers to rule out, but this is an inference, not a confirmed finding. The ATT&CK mappings in this record (valid accounts, account manipulation, email forwarding rule, email collection) are a hypothesized exposure model for defenders and are not observed adversary activity. For historical context only, DreamHost reset FTP/shell passwords in January 2012 after an unauthorized database access; no link to the 2026 event is established. Severity is an analyst estimate pending vendor disclosure.

Defender actions: rotate any password reused from DreamHost email/FTP/SFTP accounts, audit mailbox forwarding rules and recent SFTP logins and file changes for unfamiliar entries, enable MFA where available, and watch for phishing that imitates DreamHost reset emails.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1114 Email Collection
- T1114.003 Email Collection: Email Forwarding Rule

## Sources

- [DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident](https://cybersecuritynews.com/dreamhost-forces-email-and-ftp-password-resets/)
- [DreamHost Status - incident updates (File Manager, email, webmail)](https://www.dreamhoststatus.com/)
- [DreamHost Help - Change password (Mail users)](https://help.dreamhost.com/hc/en-us/articles/216479177)
- [DreamHost Help - I forgot my login credentials](https://help.dreamhost.com/hc/en-us/articles/360001190466-I-forgot-my-login-credentials)
- [Historical context: DreamHost resets customer FTP passwords following database breach (2012)](https://www.computerworld.com/article/1539555/dreamhost-resets-passwords-after-database-breach.html)
- [Historical context: DreamHost Resets All FTP/Shell/VPS Account Passwords (2012)](https://wptavern.com/dreamhost-resets-all-ftpshellvps-account-passwords)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4524