DreamHost has locked email and FTP/SFTP users out of their accounts until someone resets their passwords, and the hosting provider has said little about why. The company first reported connectivity trouble with its File Manager interface on October 23. Soon after, the problem spread to other services.
DreamHost responded by blocking access for all affected users until they complete password resets. The company calls the move a precaution. It sent recovery instructions in batches over the weekend, and every affected account owner has now received them. However, the incident remains active, and File Manager is still down at the time of writing.
The reset process creates a practical headache. Only account owners can set new credentials, so individual mailbox and FTP users have to wait for them. Moreover, DreamHost says it cannot contact those users directly. It asks owners to reach their colleagues by phone, text or another channel, because anyone whose password changed may not be able to open their email at all.
One instruction hints at a bigger problem. DreamHost tells owners to check every email address for forwarding rules and delete any destination they do not recognize. Attackers often use forwarding rules to keep reading a mailbox after a password changes. So outsiders may have reached some accounts, though DreamHost has not confirmed that. It also recommends changing any password elsewhere that matches the old one.
Long-time customers have grown frustrated. Several describe getting reset notices with no explanation and say the community has to guess. Without facts, speculation fills the gap.
The scale matters. DreamHost says it serves more than 400,000 customers in over 100 countries and supports at least 1.5 million websites and applications. It has not said how many accounts the reset affects, or whether anyone accessed files or messages.
Until the company shares details, customers can only follow the reset steps, check their forwarding rules and watch for updates.
