According to the company page, DreamHost supports at least 1.5 million websites and applications, including 750,000 WordPress installations.
What happened: forced resets after File Manager disruption
DreamHost forced password resets for email and FTP/SFTP users after an incident that first disrupted connections to its File Manager interface. The company initially reported connectivity problems affecting File Manager on October 23; the impact quickly expanded to other services, and the provider responded by blocking access to all users until they completed password resets. DreamHost described the account lockouts as a precaution.
How DreamHost is handling recovery and access
Over the weekend DreamHost sent recovery instructions in batches and notified affected account owners. The company said all affected account owners have received recovery instructions. Individual users are unable to log in until their account owner sets new credentials. DreamHost also said it cannot contact individual mailbox or FTP users directly and urged account owners to notify affected users by phone, text, or other means, because users whose passwords were reset may be unable to access their email accounts.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCustomer-facing guidance and signals of possible breach
In notifications to impacted account holders DreamHost advised users to review each email address for forwarding rules and remove any forwarding destination they do not recognize. That advisory suggests some email accounts may have been breached and exposed to external actors; DreamHost did not provide additional details about whether accounts were accessed or what data, if any, was exposed.
DreamHost also recommended that users change reused passwords elsewhere if their old DreamHost password was reused on other platforms or services. Long-time customers reported frustration at the level of public detail from the provider: "It's disturbing to get these emails with zero explanation what's going on, and very frustrating that user community has to guess," one customer said.
Scale at stake and unanswered questions
DreamHost is a U.S. web hosting provider and domain registrar offering WordPress hosting, business email, virtual private servers, dedicated servers, and cloud services. According to the company's public page, it serves over 400,000 customers in more than 100 countries and supports at least 1.5 million websites and applications, including 750,000 WordPress installations. The company did not provide a tally of how many accounts were impacted, nor did it say whether files or messages were exposed.
BleepingComputer contacted DreamHost multiple times with questions about the incident, the number of impacted accounts, and whether files or messages were exposed, but had not heard back as of publication. As of publishing, the incident remains active and access to File Manager is still unavailable.
What this means for technologists, account owners, and end users
- Technologists and security teams: Expect to check for unusual forwarding rules, look for signs of credential misuse, and treat forced resets as indicators to validate other controls. The advisory to review forwarding rules points to concerns that account access may have been leveraged to exfiltrate mail.
- Account owners and administrators: You are the distribution point for recovery — DreamHost says it cannot contact individual mailbox or FTP users directly — so owners must set new credentials and inform users by phone, text, or other means if those users cannot access email after a reset.
- End users: Follow the company guidance to change any reused passwords elsewhere and inspect email forwarding rules; users locked out by the reset will rely on their account owner to restore access.
DreamHost framed the lockouts as a precautionary step; the company has provided recovery instructions to affected account holders but has not answered questions about the scope of impact or whether content was exposed. The steps it is asking customers to take — credential resets and scrutiny of forwarding rules — are consistent with a response to suspected account compromise, but the record published so far leaves concrete exposure and total affected count undisclosed.