American hosting company DreamHost has begun taking strict security measures by enforcing mandatory password resets for email and FTP/SFTP service users, as a result of an ongoing security "incident" that led to technical disruptions and a wider impact on the company's services.
The issue began on October 23, when the company reported connectivity problems with the File Manager interface. However, the scope of the incident quickly expanded to include other services, prompting the company to block user access as a precautionary measure until the password reset process and account securing are completed.
Incident repercussions and security concerns
Although DreamHost has not explicitly confirmed a full data breach or file leak, the instructions it provided to affected parties raise serious security concerns. The company advised users to review "forwarding rules" in their email accounts and delete any unknown destinations.
Technically, this measure indicates the possibility that attackers accessed accounts and set up rules to forward messages to external addresses, allowing them to spy on correspondence or steal sensitive information without the user's knowledge. As of the time of writing, the incident is still ongoing, and the File Manager interface remains unavailable to some users.
What users must do?
Since the password resets may lock some users out of their email, DreamHost has asked account holders to notify their users through other means such as phone or text messages. The company also provided a set of essential security recommendations:
- Review mail rules: Ensure there are no suspicious forwarding rules in the email settings.
- Change reused passwords: If a user uses the same DreamHost password on other platforms or services, it must be changed immediately to avoid "credential stuffing" attacks.
- Monitor accounts: Keep track of any unusual activity in FTP or SFTP services.
It is worth noting that DreamHost serves over 400,000 customers in more than 100 countries, and supports at least 1.5 million websites and applications, making the potential impact of this incident significant in the cloud web hosting sector.