On Friday night, a freelance bookkeeper in Ohio could not get into the mailbox that runs her business. Her webmail login simply stopped working. The explanation did not come to her, because DreamHost sent it to her account owner — the web developer who set the hosting up for her four years ago and has not answered an email since August. So she sat with a locked mailbox and, two hours later, a message telling her to click here and restore her DreamHost password. That message is the real danger of the DreamHost security incident, and almost nobody is talking about it.
Confirmation: confirmed by the company. DreamHost has confirmed a service-affecting incident and forced password resets on its own status page. It has not confirmed a data breach, and it has not told anyone what, if anything, an intruder reached.
What happened, and what DreamHost actually said
The DreamHost security incident began publicly at 2:20pm Pacific on October 23, 2026, when the company’s status page opened an entry about connectivity problems with its File Manager interface. By 5:20pm the same day, the scope had widened. Webmail users were losing their sessions or hitting login errors, and the company wrote that it was resetting some email account passwords “as a precaution.”
At 10:13pm Pacific, the status moved from Investigating to Identified. The trouble now reached FTP and SFTP access too, and the resets covered both groups. DreamHost added one instruction that matters more than it looks: users should not change passwords themselves until the official email arrives.
The resets finished at 10:37am Pacific on October 24. Instruction emails then went out in batches through October 25, and by 9:32pm that evening the company said it had emailed every impacted account owner. File Manager came back online on October 26 at 3:35pm Pacific, and the entry moved to Monitoring. Some email and FTP accounts still need a password reset.
DreamHost has published no cause. BleepingComputer asked the company repeatedly and had no answer by publication. The company’s own pages describe more than 400,000 customers in over 100 countries and at least 1.5 million websites and applications, so the population here is large, even though DreamHost has not put a number on the affected share.
What was exposed, and what nobody has confirmed
This is where honesty matters. DreamHost calls it an incident and a precaution, so there is no confirmed list of exposed data, and this post will not invent one.
But two details in the company’s own instructions tell you what to protect. First, the reset covered mailbox passwords, not just control-panel passwords — so the credential at issue is the one that opens your mail. Second, according to BleepingComputer’s report, DreamHost told account holders to review each email address for forwarding rules and remove any destination they do not recognize.
That second instruction is the one to read twice. A forwarding rule is how someone keeps reading your mail after you change the password. If a company asks you to go and look for rules you did not create, then the honest reading is that the mailbox itself, not merely a list of addresses, is what needed protecting. Nobody has confirmed that, and DreamHost has not said it. Still, it is why “just reset it” undersells the job.
Why the DreamHost security incident is a phishing problem, not only a password problem
Here is the uncomfortable shape of the DreamHost security incident. Hundreds of thousands of people are now waiting for an email about a password reset, from a company they host with, carrying instructions they intend to follow. That is also an exact description of a phishing campaign.
Worse, DreamHost cannot reach most of the people affected. It has no direct line to individual mailbox or FTP users, so it asked account owners to pass new passwords along by phone, text, or some other route. Credentials are therefore moving between humans by hand this week, in a hurry, with no shared way to check what is genuine.
Scammers read status pages too. The follow-up wave after an incident like this usually arrives dressed as the company, within days, while everyone is still unsettled and expecting contact. So treat every DreamHost-branded email this week as unverified until you check it somewhere other than in the email.
What to do now
Most of this has nothing to do with us.
- Reset from the panel, not from a link. Open a browser, type the DreamHost control
- Check your forwarding rules. For each email address on the account, look at
- Change the password anywhere you reused it. If the old DreamHost mailbox password
- Turn on the strongest sign-in each account offers. For most people that means a
- If you are a mailbox user rather than the account owner, call or text the person who
panel address yourself, and change the password there. If an email asks you to click through to reset, close it and go to the panel instead.
forwarding and auto-reply settings. Delete any destination you do not recognize, then look again in a week.
also opened your bank, your store admin, or your other mail, those accounts are the real exposure now. A password manager makes the next one unique by default.
passkey where it exists and an app-based code where it does not.
manages the hosting. Do not accept a password that arrives in an email you cannot verify.
How OptMsg changes this exposure
Let us be precise, because precision is the point. OptMsg could not have stopped anything at DreamHost. That happened inside another company’s systems, and no inbox choice of yours would have changed it.
What an inbox changes is your side of the blast radius, and it does that in two ways.
Your OptMsg account has no password. Passkeys are the primary way in. So when a password leaks from some other service you signed up to with your address, there is no matching password on your inbox for anyone to try. Credential stuffing needs a password to try, and your OptMsg account does not have one. That matters beyond the mailbox, because email is the reset route into almost everything else you own. OptMsg’s security-first design starts from that fact.
The second part is about the week after. Mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash auto-deletes after 30 days. The fake “reset your password” message dressed as a hosting company lands there, where you are not reading under pressure. Community Recommendations then flag a genuinely wanted message sitting in that Trash, so you do not miss it.
What this does not cover, plainly: a compromised device, a live phishing page you type your details into, an attacker holding your unlocked phone, or a message from a sender you already approved whose own account was taken over. The argument is about stolen passwords being useless against your inbox. It is not a claim about every risk.
If this week has you rethinking which door your mail comes through, you can create an OptMsg account and forward your existing mail to it to see how it reads.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Was DreamHost hacked? DreamHost has not said so. The company describes a service-affecting incident, calls the password resets a precaution, and has published no cause. Treat the cause as unknown and the credential as compromised anyway, because that is the cautious order.
Did someone read my email? Nobody has confirmed that. DreamHost has not said what, if anything, an intruder reached. The instruction to check forwarding rules for destinations you do not recognize is the strongest public hint that mailbox access mattered here, so it is worth doing.
Do I need to change my DreamHost password myself? If you are the account owner, yes — set new passwords in the control panel, which you should reach by typing the address rather than by following a link. If you are a mailbox user, your account owner has to set it and pass it to you another way.
Why did I get locked out without an explanation? DreamHost cannot contact individual mailbox and FTP users directly, so its instructions went to account owners. If the owner is an agency or a developer who no longer answers, you may be locked out until you reach them by phone.
How do I tell a real DreamHost email from a fake one this week? Do not try to tell from the email. Check the status page and the control panel yourself, in a browser tab you opened. Any message that creates urgency and supplies a convenient link deserves exactly that treatment.
Sources
- DreamHost status page, “Investigating an incident affecting File Manager and Webmail,” updates October 23–26, 2026 — https://www.dreamhoststatus.com/
- BleepingComputer, Bill Toulas, “DreamHost forces email, FTP/SFTP password resets in ongoing incident,” October 26, 2026 — https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/
Previous in Breach Breakdown: The Keystone Data Breach Handed Strangers Your Address And What You Bought
Next in Breach Breakdown: The Denver Health Data Breach: A Vendor Key Sat Public For 417 Days
