Overview
Web host DreamHost has forced password resets for email and FTP/SFTP users in response to an ongoing "incident." The company first reported connection problems with its File Manager interface on October 23, and the impact then spread to other services.
DreamHost blocked access for all affected users until they set new passwords, which it described as a precaution. As of reporting on October 26, the incident was still active and File Manager remained unavailable.
What We Know
- Affected services: email accounts and FTP/SFTP users
- Recovery: account owners received recovery instructions in batches over the weekend. Mailbox and FTP users cannot log back in until the account owner sets new credentials.
- Scope: DreamHost has not said how many accounts were affected, or whether files or messages were exposed.
- Cause: not disclosed. The company had not responded to media requests at the time of reporting.
DreamHost's guidance to remove unrecognized email forwarding rules suggests some mailboxes may have been accessed by an outside party, but the company has not confirmed this.
What Customers Should Do
- Reset passwords for all email and FTP/SFTP accounts using DreamHost's recovery process.
- Check every mailbox for forwarding rules and remove any destination you do not recognize.
- Change reused passwords on any other service where the old DreamHost password was used.
- Tell your mailbox and FTP users. DreamHost cannot contact them directly, so account owners must pass the word on by phone, text, or another channel.
- Review site files for unexpected changes once File Manager access returns, and rotate any credentials stored in site configuration files.
Why It Matters
Hosting credentials give access to website files and mail. Forwarding rules are a common persistence trick in mailbox compromises, and FTP access can be used to plant malicious code on customer sites. Until DreamHost explains the cause, treat the incident as a possible credential compromise and act accordingly.