DreamHost Restores File Manager After Unexplained Incident, Resets Passwords
DreamHost suspended its File Manager and, as a precaution, reset some email and FTP/SFTP user passwords after an unexplained "issue" that also affected its webmail. The company says it created and deployed a fix to the File Manager and restored access. Account owners must set new passwords for affected users and change the old password anywhere it was reused.
What happened
DreamHost, a web hosting provider, suspended its File Manager and reset some email and FTP/SFTP user passwords as a precaution after an unexplained "issue" that also affected its webmail. The company says it deployed a fix and restored access to the service.
Why it matters
Customers with DreamHost email, FTP/SFTP, or File Manager must change passwords, and mailbox and FTP users depend on the account owner to get new credentials. The cause and the number of affected users remain unanswered, and the lack of explanation drew user complaints.
What to do
DreamHost account owners should set new passwords for email and FTP/SFTP users, notify those users, and change the old password on any other service where it was used. Note: DreamHost itself says it does not request password resets via email.
For the technical team
- Affected
- DreamHost Sistemas da DreamHost, incluindo o webmail DreamHost; senhas de e-mail e FTP · DreamHost File Manager (files.dreamhost.com), DreamHost webmail, and email and FTP/SFTP users whose passwords were reset.
- Exploitation
- No exploitation reported in the sources. Users speculated that passwords may have been compromised and questioned whether they were properly hashed, with no confirmation from the company.
- Fix
- DreamHost says it created and deployed a fix to the File Manager and restored access. Email and FTP/SFTP passwords were reset as a precaution. No specific version or patch was cited.
- Vector
- Unexplained. DreamHost only cited "an issue" with its systems that affected File Manager (files.dreamhost.com) and DreamHost webmail. The root cause has not been disclosed.
- More details
- DreamHost warned about the resets on Friday and suspended File Manager over the weekend; on Monday it said it was monitoring the return to full operation. It notified account owners via private communication, shared on Reddit, and stressed that only the account owner can set the new passwords. SecurityWeek asked about the number of affected users and the root cause; DreamHost had not responded.
Timeline
DreamHost confirms an issue affecting some systems and requests email and FTP password resets.
