1. News
  2. Alerts
  3. DreamHost · Security
AlertDreamHost · Security2 min read

DreamHost has an active incident and is forcing password resets

DreamHost has an active incident on its status page and is forcing password resets, which could affect websites and business email hosted there.

By the Dashline deskSource: Hacker News (100+ points)
DreamHost has an active incident and is forcing password resets
Photo: Victorgrigas, CC BY-SA 3.0
Act this week
What happenedDreamHost posted an active incident on its status page and is forcing a password reset for customers.
Who is affectedDreamHost customers who use the File Manager, email hosting or webmail, including small businesses with sites and email there.
What to do
  1. 1Open dreamhoststatus.com by typing it yourself and read the latest update.
  2. 2Reset your password only through the official DreamHost login, not through an emailed link.
  3. 3Choose a new password you do not use anywhere else, and change any other account that shared the old one.
  4. 4Be wary of emails about the reset, since scammers often copy these messages.

DreamHost, a company that runs websites and email for customers, has an active incident posted on its status page. It is also forcing a password reset. The news drew more than 100 points on Hacker News, a popular tech discussion site, where people were comparing notes.

What we know

The status page lists three things as affected: the File Manager, email hosting and the webmail interface. The File Manager is the tool for handling the files that make up a website. Webmail is the web page where people read and send email. Email hosting is the service behind business email addresses.

What is not known yet

The status page text we saw does not say what caused the incident. It does not say whether any customer data was exposed, or how many customers are affected. Until DreamHost explains more, it is best to treat the forced reset as a precaution you should follow, not a reason to panic.

Who it affects

Anyone with a site or email on DreamHost should pay attention, especially small businesses that rely on both. If you do not use DreamHost, this does not apply to you.

What to watch for

Forced resets are a favorite cover for scam emails. A fake message that looks like it comes from DreamHost can send you to a copycat login page. The steps in the alert box above cover how to reset safely. The short version is to go to the official site yourself and not trust a link in an email.

Check the status page again for updates. A fuller explanation from DreamHost would be the next thing to look for.

The takeaway

If you use DreamHost, reset your password through the official login you type in yourself, and ignore links in emails about it.

More articles

You should really read these.

Next step

Let’s talk