DreamHost has forced password resets for affected email and FTP/SFTP users while an incident affecting its File Manager remains unresolved. As of October 26, the hosting provider said affected account owners had received recovery instructions, but users could not log in until their account owner set new credentials.
The company first reported File Manager connectivity problems on October 23. According to BleepingComputer, the disruption subsequently extended to other services, and DreamHost described the password resets as a precaution. Recovery instructions went out in batches over the weekend. File Manager was still unavailable when the report was published.
In notices to affected account holders, DreamHost advised checking each email address for forwarding rules and removing any unrecognized forwarding destinations. Such rules can redirect incoming messages to another address. The warning does not establish that unauthorized forwarding occurred, and the report did not confirm whether messages or files had been exposed.
DreamHost said it could not contact individual mailbox or FTP users directly. It asked account owners to notify them by phone, text or another method, since users whose passwords had been reset might be unable to read their email. Restoring access therefore depends on account owners both setting new credentials and communicating with the people who use those accounts.
BleepingComputer also reported advice to change passwords on other services wherever an old DreamHost password had been reused.
The number of affected accounts and the cause of the incident remained unclear. BleepingComputer said DreamHost had not answered its repeated questions about the incident, its scope or potential exposure of files and messages by publication time.
