DreamHost Locks Out Email and FTP Users, Won’t Say Why
DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened.
DreamHost is forcing password resets for email, FTP and SFTP users and locking them out until the account owner sets new credentials, in what it calls an ongoing incident. It started on Oct. 23 as a connection problem with the web host’s File Manager, then spread to other services, BleepingComputer reports. As of Oct. 26, File Manager was still down and DreamHost hadn’t explained what happened.
For defenders
What’s confirmed: DreamHost blocked access for affected email and FTP/SFTP users as what it calls a precaution, and sent recovery instructions to account owners in batches over the weekend. Its notice tells owners to check every mailbox for forwarding rules and delete any destination they don’t recognize. It also says it can’t reach individual mailbox or FTP users itself, so owners have to tell them by phone or text. The incident is still open on the DreamHost status page.
What isn’t: DreamHost hasn’t disclosed the cause, how many accounts are affected, or whether any files or email were accessed, and it didn’t answer BleepingComputer’s questions. Nobody has claimed responsibility. The forwarding-rule advice hints that some mailboxes may have been tampered with, which would look like T1114.003 (Email Collection: Email Forwarding Rule), but DreamHost hasn’t said so. Treat it as possible, not confirmed.
Check: Review mail forwarding and filter rules on every DreamHost mailbox, look over FTP/SFTP logs and recently changed files on hosted sites for anything you didn’t upload, and rotate any credential that was the same as an old DreamHost password.
What it means for you
If your website or email is hosted at DreamHost, you or your staff may suddenly be unable to log in to email or upload files. That’s DreamHost’s lockout, not a problem on your end. The worrying part is the forwarding advice: if someone set your mailbox to quietly copy your mail elsewhere, they could see password resets, invoices and customer messages. DreamHost hasn’t said whether that happened to anyone.
Do this now
- Follow DreamHost’s recovery email and set a new, unique password for each mailbox and FTP/SFTP user. Then tell those users, since DreamHost won’t.
- In each mailbox’s settings, delete any forwarding address or filter rule you didn’t create.
- If you used your old DreamHost password anywhere else, change it there too, and turn on two-factor authentication on your DreamHost panel login.
- Check your website files for anything new or changed since Oct. 23.