DreamHost forces password resets amid ongoing incident

U.S. web hosting provider and domain registrar DreamHost has forced password resets for email and FTP/SFTP accounts following an incident that disrupted its File Manager interface. The company serves over 400,000 customers in more than 100 countries and supports at least 1.5 million sites and applications, including 750,000 WordPress installations.

Connectivity problems with File Manager first surfaced on October 23, but the impact quickly spread to other services. In response, DreamHost blocked access for all users until they completed password resets, calling it a precaution. Over the weekend the company sent recovery instructions in batches and notified all affected account owners. As of publication the incident remains active and File Manager is still unavailable.

Signs of possible compromise

In its notifications, DreamHost advises users to review each email address for forwarding rules and remove any forwarding destination they do not recognize. This hints that some mailboxes may have been breached and exposed to outside parties, though the company offered no further detail. Users are also told to change any passwords reused on other platforms if their old DreamHost password was used elsewhere.

Users cannot log in until the account owner sets new credentials. DreamHost adds that it cannot contact individual mailbox or FTP users directly, and urges account owners to notify affected people by phone, text, or other means — since those whose passwords were reset may be unable to reach their email.

Frustration over the silence

Long-time customers are complaining about the lack of information, leaving some to speculate about what happened. "It's disturbing to get these emails with zero explanation what's going on, and very frustrating that user community has to guess," one customer said.

BleepingComputer contacted DreamHost several times with questions about the incident, the number of affected accounts, and whether files or messages were exposed, but had received no reply by the time of publication.

Source: Bleeping Computer