Unexplained DreamHost Incident Prompts Email, FTP Password Resets

What it is

DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users after what it called "an issue" with its systems. The issue affected File Manager and DreamHost webmail. The company announced the precaution on a Friday and said on the following Monday that it had deployed a fix and restored access to File Manager.

Preconditions / Affected

Only some email and FTP/SFTP users were reset. DreamHost has not said how many, or how it chose them. SecurityWeek asked the company for the user count and root cause and had no answer when it published.

What to do

Account owners carry the work, because DreamHost says only the account owner can set the new passwords. DreamHost cannot contact individual mailbox or FTP users, so they may not know about the reset until the owner tells them.

• Set new passwords for the affected mailbox and FTP/SFTP users.
• Tell those users to change the old password anywhere else they reused it.
• Treat any email asking for a password reset as suspect. DreamHost stated it would not request resets by email.

Caveats

DreamHost has not said whether passwords were exposed, and has not described how they were stored. Some users on Reddit speculated that passwords were compromised and asked whether they were properly hashed. The company said it was still monitoring File Manager to confirm it was fully operational.