DreamHost has forced password resets for email and FTP/SFTP users after an incident that started with connectivity problems in its File Manager interface on 23 October and then spread to other services. The company has not said what caused it, how many accounts were affected, or whether files or messages were exposed.
What happened
DreamHost first reported problems reaching the File Manager on 23 October. Affected account holders were then notified that their email and FTP/SFTP passwords had been reset. In those notifications the company asked customers to review each mailbox for forwarding rules and to remove any forwarding destination they do not recognise.
DreamHost also said it cannot contact individual mailbox or FTP users directly, and asked account owners to reach those people by phone, text or another route, because anyone whose password was reset may already be locked out of their own mail. BleepingComputer asked DreamHost repeatedly for the number of impacted accounts and whether data was exposed, and had no answer at publication. Long-standing customers have complained publicly about the lack of detail.
Who is affected
DreamHost customers using its hosted email or FTP/SFTP accounts.
- Any mailbox on a DreamHost plan whose password was reset in the past few days.
- Staff who use a DreamHost mailbox as their primary business address and are now locked out.
- Website operators who publish over DreamHost FTP or SFTP, whose stored credentials no longer work.
- Anyone who set a mail forwarding rule on a DreamHost mailbox and has not looked at it since.
What to do now
Open the mailbox settings for every DreamHost address you control and read the forwarding rules line by line before you change anything else.
- Remove every forwarding destination you do not recognise. A silent forward to an outside address is how an attacker keeps reading mail after the password changes.
- Set a unique password yourself and turn on two-factor authentication wherever the account supports it.
- Reissue FTP/SFTP credentials, and delete accounts for staff or contractors who no longer need them.
- Check the sent folder and login history for activity you did not cause since 23 October.
- If a mailbox is unreachable, contact DreamHost support directly instead of waiting for a notification.
What this means for South African businesses
Few South African SMEs host mail on a US shared platform, but the instruction buried in DreamHost's own notice is the part worth copying. Forwarding rules survive a password reset, they are almost never reviewed, and they are one of the first things an attacker plants after getting into a mailbox. The judgment I would make is that the average SME has never audited its forwarding rules on any platform, which makes this a five-minute check with disproportionate value.
The primary report is at BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.