DreamHost Reset Email and FTP Passwords After an Unexplained Incident: A Checklist for Small Businesses on DreamHost

If your business website or email is hosted at DreamHost, some of your staff may have been locked out of their mailboxes since last Friday. DreamHost says that "as a precaution" it reset the passwords for a subset of email and FTP/SFTP accounts during an incident that began on Oct. 23, 2026. As of its latest status update on Oct. 26, email hosting, webmail and the File Manager were still listed as disrupted.

DreamHost has not said what caused the incident or how many customers are affected. It hasn't described it as a breach, and there's no public evidence linking it to the PHP2Shell flaws in the news this week. What's clear is what you need to do: get your people back into their accounts safely and make sure nobody falls for a fake "reset your password" email while this is going on.

What DreamHost has said

All times below are from DreamHost's status page and are Pacific time.

Oct. 23, 2:20 p.m.: DreamHost said it was investigating connectivity problems with the File Manager interface.
Oct. 23, 5:20 p.m.: It described "an incident affecting several of our services." The File Manager at files.dreamhost.com was taken offline, some webmail users were signed out, and DreamHost said it was resetting the passwords of some email accounts as a precaution.
Oct. 23, 10:13 p.m.: The issue also involved FTP/SFTP access. DreamHost asked customers to wait for its email before changing passwords, because changes made before its reset finished would be overwritten.
Oct. 24, 10:37 a.m.: DreamHost said the password reset for affected email and FTP/SFTP users was complete and that account owners could set new passwords in the control panel.
Oct. 25, 9:32 p.m.: All affected account holders had been emailed step-by-step instructions. Affected users "will be unable to log in until the owner of their DreamHost account resets their passwords and shares the new credentials with them."
Oct. 26, 3:35 p.m.: DreamHost said a fix had brought the File Manager back online and it was monitoring. Password resets were "still required for a subset of email and FTP/SFTP user accounts."

Help Net Security reported on Oct. 27 that some customers said they heard about the resets late, or only through a secondary email address, and that DreamHost still hasn't explained the cause.

Why it matters for a small business

For most small offices, a hosting company's email outage looks like this: the front desk's phone stops syncing mail, a team member can't get into webmail, and the person who set up the DreamHost account years ago has left. A dental or medical practice can miss appointment requests and referral emails. A shop or exhibit builder can miss purchase orders and proofs. A law firm or accountant can miss client documents with deadlines attached.

It's also a phishing opportunity. When customers are expecting a password reset email, a fake one is easier to fall for. DreamHost says it "will never email you asking for your password" and that its notification "will not ask you to log in through a link."

Clear takeaway

If you're on DreamHost, the account owner should log in directly at panel.dreamhost.com (never through an emailed link), set new email and FTP/SFTP passwords for anyone who was reset, hand them out by phone or in person, and tell staff to ignore any reset email they didn't expect.

What to do today

Find out whether you're on DreamHost. Check who hosts your website and email. Your IT provider, web designer or your last hosting invoice will tell you. If you're not on DreamHost, none of this applies to you.
Find the account owner. Only the owner of the DreamHost account can set new passwords for email and FTP users. Make sure that person, or someone they've given access to, is still with your business and can log in. Check the owner's inbox and any secondary address for DreamHost's instructions.
Reset from the panel, not a link. Go to panel.dreamhost.com yourself. DreamHost says new email passwords are set under "Mail > Manage Email" and SFTP passwords under "Websites > SFTP Users & Files," and that a new password can take up to 15 minutes to work.
Use new, unique passwords. Don't reuse the old password or one used anywhere else, and share the new ones by phone or in person, not by email. Then update the password on every phone, laptop and email app that checks that mailbox.
Warn your staff about fake resets. Tell everyone to ignore any password reset email they didn't ask for and to report anything that asks them to sign in through a link.
Check mail is flowing. Send a test message to and from each important mailbox (front desk, billing, orders, scheduling). Ask your website person to make sure your contact and appointment forms still deliver.
Look for anything odd. Ask whoever manages your site to check for unfamiliar FTP/SFTP users or recently changed files, and to look for forwarding rules on your mailboxes that nobody set up. If you find something, keep the evidence and get help before deleting anything.

How Brotherly Technology can help

Brotherly Technology can confirm where your website and email are hosted, help the account owner reset passwords safely, get every phone and computer reconnected, and check your site and mailboxes for unfamiliar users or forwarding rules. If you're on DreamHost and something still isn't working, call us today.