DreamHost Resets Email and FTP Passwords After an Unexplained Incident. If Your Business Hosts There, Here Is Your To-Do List
Web host DreamHost has forced password resets for a subset of email and FTP/SFTP accounts and says affected users cannot sign in until the account owner sets new credentials. The cause and scope are still undisclosed. Here is where things stand and what account owners should do now.
If your company’s website, email or file transfers run through DreamHost, someone on your team may already have been locked out. The hosting provider has reset passwords for a portion of its email and FTP/SFTP accounts after what it is calling an incident, and those users stay locked out until the person who owns the DreamHost account sets new credentials for them.
BleepingComputer first reported the forced resets, and Help Net Security pieced together the timeline from DreamHost’s status updates.
Status board
- Who: DreamHost, a U.S. web host and domain registrar. Its own figures cite more than 400,000 customers in over 100 countries and at least 1.5 million sites and apps, including 750,000 WordPress installations.
- What changed: Passwords for a subset of email and FTP/SFTP accounts were reset. DreamHost calls this a precaution.
- Who can fix it: Only the DreamHost account owner can set the new passwords. DreamHost says it cannot reach individual mailbox or FTP users directly.
- Cause: Not disclosed.
- How many accounts: Not disclosed.
- Current state: According to Help Net Security, DreamHost said on October 26 that a fix had been pushed and its web File Manager was working again, while email hosting, webmail and File Manager were still listed as disrupted on its status page. BleepingComputer’s report said File Manager was still unavailable when it published.
Day by day
- October 23, afternoon: DreamHost begins investigating connectivity problems with File Manager. Within hours it describes a wider incident. File Manager is taken offline and some webmail users are signed out or see login errors.
- October 23, evening: The company says FTP/SFTP access is also involved and starts resetting passwords. It asks customers not to change passwords themselves yet, because changes made before the reset finished would be overwritten.
- October 24: The resets are completed.
- October 25, evening: DreamHost says every affected account owner has been emailed recovery instructions, which went out in batches over the weekend.
- October 26: DreamHost reports a fix for File Manager and says it is monitoring. Resets remain required for the affected email and FTP/SFTP accounts.
What DreamHost is asking owners to do
- Set new passwords for the affected mailboxes and FTP/SFTP users, then pass them to those users by phone, text or another channel, since their email may not work.
- Check every mailbox for forwarding rules and remove any forwarding address you do not recognize.
- Change the password anywhere else the old DreamHost password was reused.
- Ignore password reset emails you did not ask for. DreamHost says it will never email you asking for your password.
Questions still open
BleepingComputer says DreamHost has not answered its questions about the number of affected accounts or whether files or messages were exposed. The advice to review forwarding rules hints that some mailboxes may have been accessed, but the company has not said so. Some longtime customers have complained about the lack of explanation, and a few have speculated online about a connection to recent PHP vulnerabilities. Nothing has confirmed that link.
A checklist for business owners on DreamHost
- Find the recovery email from DreamHost (check spam and any secondary addresses on the account).
- Reset each affected mailbox and FTP/SFTP user with a long, unique password, and share it out of band.
- Review forwarding rules, auto-replies and mail filters on every mailbox, not just the ones you think matter.
- Look over recent website file changes and FTP logins for anything you do not recognize.
- Turn on multifactor authentication for the DreamHost control panel login if it is not already on.
- Warn staff that phishing messages pretending to be from the host are likely while this is in the news.
What this means for your company
Many small businesses treat their web host as a set-it-and-forget-it utility, so an incident like this lands on whoever happens to own the hosting login. Know who that is, make sure that login is protected with multifactor authentication, and keep a current list of the mailboxes and file-transfer accounts you rely on. When a provider forces resets and says little, the safest assumption is that credentials may have been exposed. Rotate them, check for silent mail forwarding, and watch for follow-on phishing. The same playbook applies to any hosting or email provider.
Need help working through a hosting provider incident or tightening control of your email and website accounts? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
