Verify your account through DreamHost’s official control panel or support, reset the affected email or FTP/SFTP credentials as directed, and change any reused passwords on other sites. If you received a preventive notice, don’t treat it as proof that your mailbox was read.
This guide is for DreamHost email users and small teams who received a security notice, used the related file-management service, or found unfamiliar mail settings. It also covers people who want to limit which low-trust sites learn their primary email address.
Last updated October 31, 2026. Incident details checked against DreamHost’s official incident notice and its linked password guidance.
What to do after the DreamHost email security incident
Treat this as an account-risk check, not a reason to assume every DreamHost customer was affected. DreamHost’s October 29, 2026 notice says a file-manager vulnerability allowed access to some FTP/SFTP credentials and a limited number of webmail credentials. The company says it reset some potentially affected credentials, that a small number of mailbox contents may have been viewed, and that it is contacting relevant users individually. Its investigation is ongoing. Read the official incident notice for the current scope and status.
Those statements describe the incident at a service level. They do not confirm that your specific account was accessed, that your mail was read, or that credentials were used elsewhere. A preventive notice may be a reason to take a precautionary action without proving that your account was compromised.
Don’t use a password-reset link in an unexpected message. Open the DreamHost control panel independently, check for an account notice, and follow the instructions there. If the status is unclear, contact support through DreamHost’s official site.
Use this sequence to keep the response tied to the account and service you actually used:
| Your situation | First action | What it tells you |
|---|---|---|
| You received a password-reset or incident notice | Check your account through the official control panel or support | Whether DreamHost has provided account-specific instructions |
| You logged in to a related file manager | Identify the relevant FTP/SFTP user and review the associated website files | Whether your account falls within the service area described in the notice |
| You reused the same or a similar password elsewhere | Change the reused password on those other services | Reduces the risk created by credential reuse; does not prove those services were accessed |
| You see an unfamiliar forwarding rule or filter | Record the rule and confirm its origin with official support | Helps distinguish a legitimate setting from one you cannot explain |
If you received a password-reset notice
First, separate the kind of credential involved. A mailbox password controls access to that email account. An FTP/SFTP password can grant access to a website’s files. These credentials can be different, and a notice about one does not automatically establish that the other was exposed.
Sign in to the DreamHost control panel by opening the official site yourself or using a bookmark you already trust. Review account messages and security instructions there. If DreamHost directs you to change your mail-user password, follow its mail-user password instructions. If the affected credential is for a website user, use the separate website-user password instructions.
After the change, check that you can still sign in to webmail and that any mail client or device you use has the updated password. If a service keeps trying an old password, it may repeatedly fail to connect; update its saved credentials rather than weakening the new password to restore access.
Do not read the notification as evidence that someone opened your mailbox. DreamHost distinguishes credentials that may have been accessed from the possibility that some mailbox contents were viewed. Its notice also says that preventive notifications do not necessarily mean an individual account was affected. Only an account-specific update or confirmation from DreamHost can clarify your status.
If you used the related file-management service
Check whether you logged in to the file-management feature mentioned in DreamHost’s notice and which FTP/SFTP user you used. If you did, treat that user’s credentials as potentially exposed when DreamHost’s guidance indicates they may be in scope. Change the relevant password through the official control panel, and avoid reusing the new password for email or any other service.
Then review the website files associated with that user. Look for changes you do not recognize, such as new or modified files, unfamiliar scripts, or changes to site configuration. Focus on what you can verify: file names, change history if available, and whether a teammate or developer made the change. An unfamiliar file is a reason to investigate, not proof by itself that an attacker placed it.
If you manage the site with other people, ask them to confirm recent work before deleting or reverting anything. Preserve details about changes you cannot explain and ask DreamHost support for help assessing them. Avoid guessing at an attacker’s method or assuming that every hosted site was affected; DreamHost’s notice describes a limited incident scope and says the investigation is ongoing.
If you reused your DreamHost credentials elsewhere
Credential reuse is the point where risk can extend beyond the service named in the notice. If the same password, or a close variation, was used on another site, change it there too. Prioritize accounts that can reset other passwords, hold sensitive information, or control access to work systems.
Use a unique password for each service. If you use a password manager, create a distinct entry for each account rather than making a small edit to a reused password. Then check the affected services for sign-in alerts or account changes you do not recognize. A password change is a precaution; it does not mean another service was accessed.
| Credential or account | What to change | Follow-up check |
|---|---|---|
| DreamHost mailbox password identified in a notice | Change it through the control panel and official mail-user guidance | Confirm webmail and mail clients use the updated credential |
| FTP/SFTP or website-user password | Change the relevant website-user credential | Review the associated files for changes you cannot explain |
| Password reused on another site | Replace it with a unique password for that site | Check account activity and recovery settings |
| Similar password used on a high-impact account | Change it if someone could plausibly guess the variation | Confirm recovery email and authentication settings remain yours |
When changing passwords on other services, don’t imply to their support teams that they were breached unless you have evidence. You’re reducing the consequences of reuse, not asserting that those sites were involved in the DreamHost incident. For a broader way to prioritize accounts after a credential exposure, see this guide to deciding which reused passwords to change first.
If you found unfamiliar forwarding rules or filters
Check webmail settings directly, rather than following a link in a message. Review forwarding addresses and filters that redirect, delete, archive, or mark incoming mail. A forwarding rule may quietly send copies of messages elsewhere, while a filter can make expected mail difficult to find.
Sort each setting into one of three groups:
- Recognized: You remember creating it, or a teammate confirms it is an intentional workflow.
- Unclear: You cannot identify who created it or why it exists.
- Clearly unfamiliar: The destination or behavior is not one you or your team authorized.
For an unclear or unfamiliar rule, record its destination and conditions before changing it. Check with teammates who administer the mailbox, then ask DreamHost support to verify the setting if its origin remains uncertain. If it is clearly unauthorized, follow DreamHost’s advice and remove or disable it; also change the mailbox password if directed. Don’t guess about how a rule appeared or attribute it to a particular attacker without confirmation.
The practical difference is important: a rule you recognize may be part of your normal workflow, while an unknown destination deserves prompt investigation. Avoid deleting legitimate filters simply because they look unfamiliar at first glance. If you want a separate guide to the limits of temporary addresses and long-term mail access, read about email privacy decisions.
If a message claims to be about the incident
DreamHost’s notice says its incident-related emails will not ask you to log in through an email link or provide your password. Treat that as a useful boundary, not as a complete authenticity test. A display name can be misleading, and one familiar-looking detail does not prove that a message is genuine.
Instead, open the control panel independently and compare its account notices with the email. If the message asks for a password, urges you to sign in through a link, or asks for other sensitive credentials, do not comply through that message. Contact DreamHost through its official support channel and share the message details if you need help verifying it. Keep the distinction clear: an unexpected message may be suspicious, but its appearance alone does not establish who sent it.
Where email isolation helps—and where it does not
Changing passwords and reviewing account settings are incident-response steps. Email isolation is a separate choice for future signups. Giving low-trust services a separate address can reduce how often they receive your primary email, but it cannot retract a password that may have been exposed, secure an existing DreamHost account, or replace a unique password.
Use a long-term address you control for banking, payments, government services, and accounts you may need to recover later. Those services can require continuing access to password resets, statements, or account alerts. A disposable address is a poor fit if you may lose access before you need to recover the account.
| Option | Best fit | Main privacy benefit | Important limitation |
|---|---|---|---|
| Primary mailbox | Important accounts and ongoing correspondence | Stable access to recovery messages | Sharing it broadly can make it a common destination for unwanted mail |
| Email alias or forwarding address | Ongoing accounts where you want separation | Can help separate identities or identify which address receives mail | Depends on continued access to the underlying mailbox and the alias service |
| Temporary email address | A low-trust signup or short-lived interaction | Keeps your primary address out of that registration flow | May not suit password recovery, ongoing correspondence, or accounts you need to keep |
Choose based on how long you need the account and whether you must receive future recovery mail. For more on how temporary addresses differ from primary email, see the temporary email guide. Do not treat an isolated address as a fix for the DreamHost incident: account recovery and credential changes must come first.
Work through the response in milestones
Now: Open the DreamHost control panel independently. Read any account-specific notice and identify whether it concerns a mailbox, an FTP/SFTP user, or both. If the notice does not answer that, use official support.
After confirming the affected credentials: Change the relevant password using DreamHost’s instructions. If you used the same or a similar password elsewhere, update those services with unique passwords. Do not assume they were accessed; check their account activity.
During your account review: Inspect mailbox forwarding and filters, confirm which ones you recognize, and ask support about settings you cannot explain. If you used the related file-management feature, review the files associated with the relevant user and check with your team before undoing changes.
For future signups: Keep a stable, recoverable mailbox for important accounts. Use an isolated address only where ongoing access is not important and where the service permits it. That separation can limit future exposure of your primary address, but it does not resolve current account risk.
Frequently asked questions
Does the incident affect every DreamHost customer?
No. DreamHost says some FTP/SFTP credentials and a limited number of webmail credentials were affected, and that its investigation is ongoing. A preventive notice does not prove that your account was accessed or that mailbox contents were viewed. Check your account directly and rely on account-specific guidance rather than assuming either universal impact or universal safety.
What should I do after a DreamHost password-reset notice?
Open the official control panel independently. Check the account notice, identify which credential it concerns, and reset it through DreamHost’s official instructions. If the notice arrived by email, don’t use its login link or reply with a password. If your account status remains unclear, contact official support and ask whether action is required for your specific account.
Do I need to change passwords on other sites?
Yes, if you reused the DreamHost password or a close variation elsewhere. Change those passwords to unique ones, prioritizing accounts that can reset other accounts or contain sensitive data. This is a precaution against credential reuse, not evidence that another site was accessed. Review account activity after the change and investigate alerts you cannot explain.
How do I check for an unfamiliar email-forwarding rule?
Open your mail settings directly and review forwarding destinations and filters. Compare them with settings you remember creating or that your team confirms are legitimate. For a rule you cannot identify, record its details and ask DreamHost support to verify it. Don’t remove a rule solely because it looks unfamiliar until you have checked whether it supports a legitimate workflow.
Once you’ve handled the DreamHost account checks, treat future email separation as prevention—not repair. For a low-trust signup that does not need long-term recovery, MaskSend can help keep your primary address out of that registration flow. Keep your regular, recoverable mailbox for accounts where you may need ongoing access.
Frequently asked questions
Does the DreamHost incident affect every customer?
No. DreamHost says the incident affected some FTP/SFTP credentials and a limited number of webmail credentials, and that its investigation is ongoing. A preventive password-reset notice does not by itself prove that your account was accessed or that your mailbox contents were viewed. Check your account status directly with DreamHost rather than inferring personal impact from the notice alone.
What should I do after a DreamHost password-reset notice?
Open the official DreamHost control panel independently, not through a link in the message. Check for account notices, reset the relevant mailbox or website-user password as directed, and confirm that recovery details and mail settings are yours. If the panel does not clarify your status, contact official support and keep the message available for reference without replying with credentials.
Should I change passwords on other sites after this incident?
Change passwords anywhere you reused the affected DreamHost password or a close variation, starting with accounts that can reset other accounts or contain sensitive information. Use a unique password for each service. This is precautionary risk reduction: credential reuse does not establish that another site was accessed, so review those accounts for unusual activity rather than assuming compromise.
How can I tell whether an email forwarding rule is unfamiliar?
Open your webmail settings directly and inspect forwarding addresses, filters, and rules that redirect, delete, archive, or mark messages. Compare each entry with changes you remember making. If you cannot identify who created a rule, capture its details and ask DreamHost support to verify it before removing anything that could be needed for legitimate mail handling.
Test email delivery now
Use a disposable inbox for short-term sign-ups and an independent forwarding alias for lasting relationships. Save your real email address for communication you trust.