As reported by BleepingComputer, DreamHost — a major U.S. hosting provider serving more than 400,000 customers and 1.5 million websites, including 750,000 WordPress installations — is forcing password resets across email and FTP/SFTP accounts following an undisclosed incident that began October 23, 2026. Access to the File Manager interface remains blocked, and the incident is still active.

Key Takeaway: Email forwarding rules are a favorite persistence mechanism for business email compromise actors — they allow quiet exfiltration of inbound mail without needing ongoing credential access.

What makes this noteworthy is not the reset itself but the secondary advisory: DreamHost told account owners to inspect every email address for unrecognized forwarding rules. That instruction is a meaningful signal. Email forwarding rules are a favorite persistence mechanism for business email compromise actors — they allow quiet exfiltration of inbound mail without needing ongoing credential access. If DreamHost is telling customers to hunt for rogue rules, it strongly suggests attackers had mailbox-level access long enough to configure them.

Why This Matters Beyond DreamHost

Hosting providers occupy a privileged position in the supply chain. A compromise of their file management and email infrastructure has cascading consequences:

  • Credential reuse blast radius — DreamHost's own advisory tells users to change reused passwords elsewhere. Given how common credential reuse remains, a meaningful subset of those 400,000 customers now have exposed credentials floating in attacker hands, potentially opening doors to unrelated banking, SaaS, and corporate accounts.
  • WordPress exposure — with 750,000 WordPress installs under management, FTP/SFTP credential compromise could mean attackers have direct file access to a large number of sites. Web shell deployment, defacement, or SEO spam injection are all realistic follow-on actions.
  • Email exfiltration — if forwarding rules were set, sensitive correspondence, password reset links, MFA codes, and business communications may have been silently copied to attacker-controlled addresses for days or longer.
The communication gap is itself a security issue. When a provider forces resets but offers no scope, timeline, or impact assessment, defenders cannot make risk-informed decisions about whether to treat this as routine maintenance or a full-blown incident response.

What Defenders Should Do Now

Whether or not you are a DreamHost customer, this incident offers lessons that warrant immediate action:

If you host with DreamHost:

  • Reset all passwords — not just the ones DreamHost flagged. Assume FTP, SFTP, email, and panel credentials are burned.
  • Audit every mailbox for forwarding rules, filters, and delegated access. Remove anything you cannot account for by name.
  • Rotate WordPress admin, database, and salts keys if you manage WP through DreamHost. Check wp-content/ and wp-config.php for unauthorized modifications.
  • Review SMTP send logs if available — look for outbound mail from your domains that you did not authorize.
  • If you reused your DreamHost password anywhere else, rotate those credentials now and enable MFA on every account that supports it.

As a general supply-chain hygiene practice:

  • Maintain an inventory of which providers hold credentials, file access, or mail routing for your organization. When one of them has an incident, you need that list in minutes, not hours.
  • Treat hosting provider credentials as privileged access. Use a dedicated password manager, unique credentials per service, and MFA wherever the provider offers it.
  • Monitor DMARC and DKIM reports for unexpected mail originating from your domains — a forwarding rule may not show up in your own logs but will surface in authentication failure data.

The Transparency Problem

DreamHost's silence is the most frustrating element for defenders and customers alike. Forced resets are a reasonable precaution, but they cannot replace disclosure. Customers need to know: what was accessed, when, how, and whether data was exfiltrated. Without those answers, every DreamHost customer is left doing incident response in the dark — checking logs that may not exist, trusting mailboxes that may have been forwarding to attackers, and hoping the reset was proactive rather than reactive to a compromise the company has not yet admitted.

Incidents like this reinforce a hard truth: your hosting provider's security posture is your security posture. Vet them accordingly, and never assume their crisis communications will be adequate when it matters.