DreamHost incident, October 2026: what to do now

As of October 27, 2026, 03:27 JST (October 26, 11:27 AM PDT). Every fact that can change carries the time it was checked, in JST (UTC+9), with DreamHost's own Pacific time beside it. DreamHost's latest status update was posted on October 25 at 9:32 PM PDT, and the incident was still marked "Identified".

DreamHost reset some email and FTP/SFTP passwords on October 23 and 24, 2026, and its File Manager is still offline. If you own the account, set new passwords at panel.dreamhost.com under Mail > Manage Email and Websites > SFTP Users & Files, allow up to 15 minutes, and upload site files over SFTP.

Until the owner does that, reset users "will be unable to log in", DreamHost says. It lists web hosting, VPS, DreamPress, databases, phpMyAdmin, and its panel as operational, so sites keep loading. It hasn't said what caused the incident or how many customers it affects, and most of its updates repeat one warning: "DreamHost will never email you asking for your password."

Below: the steps in order, which services are affected, what DreamHost has said about File Manager, how to get a page or a site change live while it's down, and the timeline from DreamHost's status page.

What to do, in order

DreamHost's instructions are spread over nine status updates, and the early ones changed: on October 23 it asked owners to wait for its email before changing passwords, because changes "will be overwritten" while the reset ran. Since October 24 at 10:37 AM PDT, the reset is complete and there's no need to wait. This order starts with the step that stops a fake reset email from working, then gets mail and file access back, then checks for changes you didn't make.

1. Don't use links in password emails

DreamHost says its notification "will not ask you to log in through a link", and that you can ignore a password reset email you didn't request. Type panel.dreamhost.com into your browser yourself. If an email claims to be from DreamHost and asks for a password, it isn't from DreamHost.

2. Set new email passwords in the panel

Sign in to panel.dreamhost.com as the account owner, open Mail > Manage Email, click Manage next to an address, and use Change Password (DreamHost's help article for mail users). DreamHost's status page says to allow up to 15 minutes for the new password to take effect. Users can't change it from Webmail. If you saw a "Failed to edit" error on Professional Email, DreamHost says that's fixed: try again.

3. Give each mail user the new password, and update their apps

A reset mailbox stops accepting the old password in webmail and in "your email apps (Outlook, Apple Mail, your phone)", in DreamHost's words. Send each user their new password through a channel other than that mailbox, and update it in every app and device that signs in, including any website form or script that sends mail through that account over SMTP.

4. Set new SFTP passwords

Open Websites > SFTP Users & Files, click Login info for the user, then Change password (DreamHost's help article for website users). Then update the password everywhere it's saved: your SFTP client (FileZilla, Cyberduck, Transmit), a deploy script, and the secrets of any CI job that uploads to DreamHost. A deploy that fails to log in on its next run is the usual sign that one was missed.

5. Check forwarding rules and filters

DreamHost's status page doesn't mention forwarding. CyberInsider reports that customer notifications posted online recommend "checking email forwarding settings and removing any unfamiliar destinations." A forwarding rule keeps copying mail out after a password change, so look at each mailbox's forwarding and filters, and remove any destination you didn't add.

6. Upload site files over SFTP until File Manager returns

Web hosting is operational, so your sites still load. To change a file, connect over SFTP on port 22 with the user's new password. DreamHost's FTP overview says the hostname is your site's domain once its DNS points to DreamHost, or the server name shown on the Manage Websites page otherwise.

7. Watch the status page for File Manager and a final update

DreamHost says it "will post an update here when it is restored." Until it does, assume files.dreamhost.com is unavailable, and plan any change around SFTP.

Which DreamHost services are affected

From the components list on dreamhoststatus.com, checked October 27, 03:27 JST (October 26, 11:27 AM PDT).

Why File Manager is down

DreamHost hasn't said. Its first update, on October 23 at 2:20 PM PDT, reported "connectivity issues affecting the File Manager interface", and its 5:20 PM update widened that to "an incident affecting several of our services." Its two updates of October 25 say File Manager is still unavailable and that work on it continues. DreamHost hasn't given a cause, a number of affected customers, or a date for File Manager's return (checked October 27, 03:27 JST). CyberInsider's report of October 26 says the same: DreamHost "has not disclosed how many customers are affected."

On Hacker News, where a link to the status page has 164 points, one commenter quotes DreamHost's email to account owners: "As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account." That matches the status page, and it doesn't say which systems were accessed.

Getting a page up while File Manager is down

For a change to your DreamHost site, SFTP is the way: it works with the new password, and web hosting is up.

If what you need is a page outside DreamHost, for example a notice telling customers your email is down and giving them another way to reach you, or a one-page site you'd normally have uploaded through File Manager, Convika's free HTML publishing tool turns an HTML file into a link without an account. Drop your .html file, or paste code from ChatGPT, Claude, or Gemini, and click Get my preview link. The preview link stays live for 3 minutes, with scripts and forms turned off.

To keep the page, click Keep this page — free, no card and sign up. The page moves into your account as you uploaded it, and you can add a form from the dashboard with Add a form to my page so customers can write to you while your mailbox is reset: entries arrive in the dashboard and by email (Free shows 50 entries a month). Then click Publish page, choose Public under Who can open this page?, click Next, and the first time, click Publish free. The page goes live at once at a convika.page address, with the Convika bar at the bottom. The Free plan gives you 1 published page, and a Public page may show in search results and Convika's gallery, so leave out anything internal. If the email address on your Convika account is a DreamHost mailbox that was reset, set its new password first, or sign up with another address, because the entry emails go there.

Publish my HTML file as a link

What happened: the timeline

All from dreamhoststatus.com, read October 27, 03:27 JST. DreamHost posts in Pacific Daylight Time (UTC−7); JST is 16 hours ahead.

Updates to this page

This page changes when DreamHost restores File Manager, resolves the incident, states a cause, or changes its advice. The same month: Railway security incident, October 2026: what to do now, and for PHP sites on shared hosting, PHP October 2026 security release: what to update.

Frequently asked questions

Is DreamHost down right now?

Not for websites. DreamHost lists web hosting, VPS, DreamPress, databases, and its panel as operational. File Manager, email hosting, and webmail show a service disruption, and some mail and FTP/SFTP users can't sign in until the account owner sets a new password (checked October 27, 03:27 JST).

Why was my DreamHost email password reset?

DreamHost calls it a precaution taken during an incident "affecting several of our services". It hasn't said which accounts were chosen or why. If your mailbox stopped accepting its password, the account owner sets a new one under Mail > Manage Email.

Where do I change my DreamHost password?

Only in the panel at panel.dreamhost.com, as the account owner or a user with privileges: Mail > Manage Email for mailboxes, and Websites > SFTP Users & Files for SFTP users. You can't change a mail password in Webmail. If you're a mail or FTP user and not the owner, ask the owner.

I got a DreamHost password reset email. Is it real?

Don't click its link either way. DreamHost says its notification "will not ask you to log in through a link" and that you can ignore a reset email you didn't request. Go to panel.dreamhost.com yourself.

Do I still need to wait for DreamHost's email before resetting?

No. That was DreamHost's advice on October 23. Since October 24 at 10:37 AM PDT, it says the reset is complete and owners can set new passwords "now".

How long does a new DreamHost password take to work?

DreamHost's status page says to allow up to 15 minutes. Its help article for SFTP users says up to five minutes.

When will DreamHost File Manager be back?

DreamHost hasn't given a date. Its latest update, October 25 at 9:32 PM PDT, says work continues and that it will post on the status page when File Manager is restored. Use SFTP in the meantime.

Was my DreamHost website hacked?

DreamHost hasn't said that any website files were changed or accessed, and it hasn't published a cause. If you want to check, compare your site's files over SFTP with your own copy, and look for files or admin users you didn't add.

How many DreamHost customers are affected?

DreamHost hasn't said. CyberInsider notes the company serves more than 400,000 customers, and that it "has not disclosed how many customers are affected by this incident."

Sources

Times are when this page read each source, in JST on October 27, 2026. Each source's own date is in its entry.

• DreamHost Status, incident "Investigating an incident affecting File Manager and Webmail", opened October 23, 2:20 PM PDT, latest update October 25, 9:32 PM PDT (03:27)
• DreamHost Knowledge Base: Change password (Mail users), last updated July 20, 2026 (03:29)
• DreamHost Knowledge Base: Change password (Website users), last updated July 13, 2026 (03:30)
• DreamHost Knowledge Base: FTP overview and credentials (03:37)
• CyberInsider: DreamHost forces password resets amid ongoing service disruption, October 26, 2026 (03:28)
• Hacker News: Active incident at Dreamhost forcing password reset, 164 points (03:29)

Updates

• October 27, 2026: Published. Sources read October 27, 03:27 to 03:37 JST.