DreamHost Asked Customers to Check Their Mail Forwards. A New Password Doesn’t Remove One.
The host hasn’t said why it expired some mail and SFTP passwords. Two lines in its notice still tell you what to check after any reset.
On 23 October, DreamHost started resetting the passwords of some email accounts. By that night the resets covered FTP and SFTP users too. The status post was marked resolved on 27 October at 4:45 PM Pacific, and the notice in DreamHost’s help center is still up, last updated on 26 October.
I read both pages in full this morning because of one line in the notice. Right after telling owners to “set a new password for each email address”, it asks them to “take a moment to review the forwarding settings on each address and remove any forward that you don’t recognize or may no longer use.”
Neither page says what happened. The notice says the passwords “were recently expired” “to ensure the continued integrity of DreamHost customer accounts”. The status feed says “as a precaution” and gives no count of affected accounts. A separate status post from 21 October, about a PHP vulnerability, says DreamHost had “not observed any attack traffic related to this issue to date”. I’m not going to guess at a cause. This story is about the two requests in the notice. They apply whatever the reason was.
What a forward does after the password changes
A forward is a setting on the address. It doesn’t sign in and it doesn’t hold a session, so a new password has nothing to cut off. If a mailbox forwards to an outside address, new mail keeps going there after the reset, and someone reading that mailbox normally sees nothing different.
Microsoft’s guide to recovering a compromised Microsoft 365 mailbox treats this as a separate step. It says its steps cover “known methods that might allow the attacker to maintain persistence and regain control of the account later.” Disabling the account or resetting the password is step 1. Reviewing mail forwarders is step 6, with its own command for inbox rules, “including hidden ones”, that forward or redirect messages. The guide’s list of symptoms includes “Recently added external email forwarding” and rules that move messages into the Notes, Junk Email or RSS Subscriptions folders.
DreamHost’s panel is not Microsoft 365, and its notice doesn’t say anyone added a forward to anything. It asks owners to look. The place to look is Mail > Manage Email in the DreamHost panel, the same page where the new passwords get set.
The second request: don’t use the mailbox to announce the change
The notice then asks owners to contact their users, “such as employees, clients, or family members”, and recommends “a phone call, secure text, or any private channel other than their DreamHost-hosted email address.”
DreamHost gives a practical reason: those users can’t open their inbox until they have the new password. Microsoft’s guide gives a second reason for the same advice: “Don’t send the new password to the user through email, because the attacker could have access to the mailbox at this point.”
Get Josepollman’s stories in your inbox
Join Medium for free to get updates from this writer.
Six of the eleven updates in the status feed carry some version of the same warning: “We will never email you asking for your password”, and the notification “will not ask you to log in through a link”. Go to panel.dreamhost.com directly. That warning matters more than usual here. Affected owners were emailed in batches between 24 and 25 October, and two days of real notices arriving is also two days in which a fake one would look normal.
Why I care about this from the payment side
I build vetthisvendor.com, a free tool that checks a supplier before you pay them: VAT registration, IBAN checksum, sanctions lists, the company register, and whether their email domain can be forged. The site’s own FAQ says what it can’t catch. Asked whether a clean result means it is safe to pay, the answer is no: “These checks cannot detect the most common invoice fraud, where a real supplier’s mailbox is compromised and only the bank details are changed.”
Microsoft’s step 6 reads “Remove any suspicious mailbox forwarding that the attacker added.” A forward is a quiet way to keep reading a mailbox after losing the password. Whoever holds the copy still sees the threads: purchase order numbers, payment terms, the name of the person who normally sends the invoices and how they sign off. My guide on supplier bank detail changes describes the same trick from the other end, a mailbox rule that hides your replies from the real supplier, “which is why ‘I emailed to check and they confirmed’ is not confirmation.”
So “they’ve reset their passwords” is not the reassurance it sounds like. If a supplier tells you they had a password reset, on any host, two checks matter: a forwarding check on their side and a confirmation call on yours. The call goes to a number you already had, from an old invoice, your accounting system, or their website that you went to yourself. Not the number in the email signature, because whoever controls the mailbox controls the signature too.
What I’d do this week with a DreamHost account
- Set the new passwords at panel.dreamhost.com, typed into the address bar, not reached through a link in an email.
- While on Mail > Manage Email, read the forwarding settings on every address. Remove anything you don’t recognize, as the notice asks, and anything nobody uses any more.
- The notice only mentions the forwarding settings on that panel page. If your users can set up their own filters or rules somewhere else, check those separately.
- Give each user their new password by phone or text, never by email to the address you just reset.
- Update the saved password in every mail, FTP and SFTP client that stores it, as the notice reminds you.
The part a notice can’t do
A host can expire passwords from its side. It can’t tell which forwards were meant to be there. Only the owner knows that, which is why the notice asks instead of deleting them.
Payments work the same way. A tool can tell you an IBAN is well formed and a VAT number is registered. It can’t tell you whether the supplier really asked for the money to go somewhere new. In both cases the last check is a person, reached through a channel the attacker doesn’t control.
Sources, opened 28 October 2026: DreamHost Knowledge Base, “Current Status Notifications”, notice of October 25, 2026 (last updated October 26). DreamHost status history feed, “Investigating an incident affecting File Manager and Webmail”, updates of 23 to 27 October. Microsoft Learn, “Respond to a compromised email account in Microsoft 365”.
