DreamHost Customers Must Manually Reset Account Passwords
The company mandated password resets for specific email and FTP users following a security incident that disrupted core services.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust your cloud service providers to adequately protect your account information?
DreamHost has completed a mandatory password reset for specific email and File Transfer Protocol (FTP) users following a security incident. The disruption, which began on Oct. 23, specifically impacted the company's browser-based File Manager and webmail systems.
Why it matters
This incident highlights the ongoing vulnerability of shared hosting infrastructure to credential-based disruptions. As a provider for over 400,000 global customers, the company's forced reset aims to contain unauthorized access to sensitive service accounts.
DreamHost maintains a total user base of 400,000 customers worldwide. The technical impact is limited to specific email and File Transfer Protocol configurations, necessitating manual credential updates via the control panel.
The players
DreamHost
A web hosting and cloud services provider that serves over 400,000 customers globally.
The details
The incident forced a reset of authentication protocols for two primary service layers: File Transfer Protocol (a standard network protocol for transferring files between a client and server) and webmail systems. Administrators are required to generate new credentials within the company control panel, while individual users must then update these settings in their local email applications to re-establish connectivity.
Timeline
Oct. 23, 2026: The security incident and subsequent service disruptions began.
Oct. 24, 2026: DreamHost finalized the password reset process for affected accounts.
The Tech Race
This incident reflects a recurring security challenge in the managed hosting industry, where service providers must balance rapid incident response with user accessibility. It follows a established pattern in the sector where forced credential resets are used to mitigate unauthorized access to shared infrastructure.
Affected customers must log in to their DreamHost control panel to manually assign new passwords for their email and File Transfer Protocol accounts. Users should subsequently update these credentials in their local mail clients and FTP software to restore full functionality.
The takeaway
Users should treat this reset as a baseline for auditing other service permissions and enabling multi-factor authentication where available. Monitor the official DreamHost status page for updates regarding the ongoing resolution of the browser-based File Manager service.
Further reading
For more information on securing shared hosting environments, visit our Cybersecurity section.
Source note: This article includes information reported by SC Media.
Live Poll
Do you trust your cloud service providers to adequately protect your account information?
