DreamHost forced password resets on some email and FTP users after an unexplained incident that began October 23, and it still has not said how many accounts were hit.
If your domain email, blog files or supplier-facing mailbox sit on DreamHost, a locked mailbox is a locked store. Order confirmations, carrier quotes, supplier invoices and every password-reset link for Shopify, your ad accounts and your registrar land in that inbox, and for a high-ticket store each of those messages is tied to real money. This is the kind of vendor failure operators should plan for before it happens, which is the whole point of how we build stores at Ecommerce Paradise.
Below: what DreamHost has confirmed and what it has not, how the incident compares with past hosting breaches, what a dead or hijacked mailbox does to a store doing real volume, and six steps to finish this week. I have also covered the PHP2Shell exploitation hitting store hosts on EP, and this incident sits on the same fault line: the boring infrastructure around your store is where attackers and outages hit first.
Vendor incidents are exactly why your business should sit on a clean legal footing: form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. It has operated for 25 years under stable ownership, which is more than you can say for cheap formation sites that churn and upsell. Form your LLC with Northwest →
DreamHost Password Resets: What Hit Email and FTP Since Oct. 23
DreamHost’s status page shows the incident opened at 2:20 p.m. Pacific on October 23 as an investigation into File Manager connectivity issues. By 5:20 p.m. the File Manager was offline, some webmail users were signed out, and the company had started precautionary password resets for some email accounts, according to the DreamHost status page.
At 10:13 p.m. that night the scope widened to FTP and SFTP access, and users were told to wait for reset instructions before changing anything. DreamHost reported the resets complete at 10:37 a.m. on October 24, at which point account owners could assign new passwords in the control panel. Most instruction emails had gone out by October 25 at 11:43 a.m., and the last of the impacted account holders were emailed at 9:32 p.m. that day.
On October 26 at 3:35 p.m. Pacific, the status page said a fix was in place and the File Manager was back online under monitoring. Resets were still required for a subset of email and FTP/SFTP accounts. The page lists File Manager, email hosting and the webmail interface as disrupted, with phpMyAdmin marked operational.
Per CyberInsider, website hosting and the main control panel stayed up throughout. Affected passwords have expired and no replacements are assigned, so those mailboxes and FTP users cannot log in until the account owner sets new credentials. DreamHost says it cannot contact individual mailbox or FTP users, so the account owner has to relay the new password to everyone who uses the account.
DreamHost serves more than 400,000 customers in over 100 countries and supports at least 1.5 million websites and applications, BleepingComputer reported on October 26. The same story says DreamHost has not disclosed how many accounts were affected or whether files or messages were exposed, and that the outlet contacted the company multiple times without a response. One customer told BleepingComputer: “It’s disturbing to get these emails with zero explanation.”
DreamHost’s guidance is specific. Set email passwords under Mail, then Manage Email, and FTP/SFTP passwords under Websites, then SFTP Users and Files; changes can take up to 15 minutes. Review every mailbox for forwarding rules and remove any destination you do not recognize. Update the passwords inside any email app, and change the old DreamHost password anywhere you reused it. The company also says it will never ask for a password by email and points users to its official panel for updates.
GoDaddy Set the Precedent for Hosting Credential Incidents
Hosting providers have been hit this way before. GoDaddy disclosed in a February 17, 2023 SEC filing that attackers had breached its cPanel shared hosting environment, stolen source code and installed malware, and it called the activity part of a “multi-year campaign by a sophisticated threat actor group,” per BleepingComputer’s coverage.
The same report ties that event to earlier ones. In November 2021, attackers using a compromised password breached GoDaddy’s Managed WordPress environment and exposed email addresses, WordPress admin passwords, sFTP and database credentials for a subset of 1.2 million affected customers. In March 2020, GoDaddy alerted 28,000 customers whose hosting credentials had been used to reach accounts over SSH.
The counterpoint matters. Nothing published so far says DreamHost’s incident resembles GoDaddy’s, and DreamHost itself frames the resets as a precaution. SC Media describes a security incident, while DreamHost’s own status account calls it “an incident affecting several of our services,” so even the label is disputed. No source I found confirms stolen data, and website hosting stayed online for the entire stretch.
What the precedent does show is where attackers go. Credentials for email, FTP and the control panel are the cheapest way into a hosted business, which is why my read is that a vendor expiring them on purpose is acting on a concern it has not yet explained. Until DreamHost says more, treat the cause as unknown and act on the mailbox risk that you can control.
Three questions are still open, and they decide how worried you should be. How many accounts were reset, was any mail or file content read or copied, and did the cause start inside DreamHost or with stolen customer logins? If DreamHost answers those publicly, the risk picture changes in either direction. Until then, assume the worst case for any mailbox that handles money.
Why One Locked Mailbox Can Freeze Your Store Operations
My read: the DreamHost story is less about DreamHost and more about how many things your mailbox controls. Your Shopify store runs on Shopify’s infrastructure, not DreamHost’s, but the password reset for Shopify, your Google Ads and Merchant Center logins, your registrar and your bank all route through an inbox. Whoever controls that inbox can reset the rest.
Think about the order of operations in a bad week. A lockout hits, you scramble to regain access, and somebody clicks a reset link sent to a mailbox you do not fully control. If that mailbox is the recovery address for your Google Merchant Center, your ad account or your payment processor, one compromised inbox can turn a two-day annoyance into suspended ads and frozen payouts. Recovery addresses are the hidden dependency most operators never audit.
That is why the forwarding-rule warning is the line I would not skip. The FBI’s April 30, 2026 public service announcement on freight fraud lists “new or unauthorized mailbox rules,” such as forwarding to external addresses, auto-deletion or hidden folders, as indicators of compromise. The same notice puts estimated 2025 cargo theft losses in the US and Canada at nearly $725 million, up 60% from 2024, with the average theft at $273,990, up 36%.
The FBI notice is about logistics impersonation, not DreamHost, so I am not tying the two together. But a high-ticket store ships freight, and carrier and supplier emails are the raw material for exactly that fraud. A forwarding rule that quietly copies those emails to a stranger would survive a password reset unless you delete it, and neither DreamHost’s guidance nor the reporting says resets remove existing rules.
Here is rough math, and it is hypothetical. Say your store does $100,000 a month in revenue, about $3,333 a day. A three-day mailbox lockout leaves roughly $10,000 of order flow waiting on supplier confirmations and customer replies that cannot get through. Separately, say a fake “our bank details changed” email on an $18,000 supplier invoice slips past an inbox you did not check. One of those costs you days, the other can cost you the invoice.
Here are the scenarios I would use, with thresholds. If your order, supplier or support mailboxes are on DreamHost, treat this as a same-day job and finish the checklist below. If only your blog or FTP files are on DreamHost, you have a smaller exposure and should still rotate those credentials. If nothing is there, spend ten minutes finding out where your domain’s email actually lives, because many store owners cannot answer that without looking.
This also changes how I would run email. Marketing sends through Klaviyo and Shopify order notifications use your domain, so when the reply-to mailbox dies, replies bounce and customers assume you have gone dark. Keep the sending tools, the mailbox and the registrar on separate vendors with separate logins, the same logic I laid out in my post on why your payment processor is a single point of failure.
Customers feel the lockout before you do, and that is amplified in the high-ticket model, where orders are few and the tickets are big. A buyer who emails about a $4,000 order and gets no reply for 72 hours does not wait politely, and some of them will open a dispute or buy from a competitor. Put a phone number on your site, keep a second support address on a different provider, and tell customers where to reach you if the first one fails.
Access also spreads to people. Every VA with a mailbox login is another credential that can be phished or reused, and I wrote about vetting remote hires and VAs for the same reason. Fewer shared logins, one owner per mailbox, and a written list of who can reach what keeps a vendor reset from turning into a week of chaos.
If this is the sort of operational load you would rather hand off, that is the case for a done-for-you build from my team, where mailboxes, registrar, store and suppliers are set up with separate logins from day one.
A dead mailbox should not stall a store that is already making sales. Want my team to scale the store you already have, with the plumbing handled? See the scaling service →
DreamHost Reset Checklist: 6 Steps for Store Owners This Week
Do these six in order. Steps one to three take under an hour for most stores.
- Log in to the DreamHost panel by typing the address yourself, not from an email link, and check Mail, then Manage Email, and Websites, then SFTP Users and Files, for expired accounts. Search your inbox for DreamHost’s instruction email, and remember the company says it never asks for passwords by email.
- Set a new, unique password on every mailbox and FTP user, store them in a password manager (my comparison of 1Password alternatives for store owners covers the options), and update every email app and phone. Change the old password anywhere you reused it.
- Open every mailbox’s forwarding, filter and auto-delete settings and remove any rule you did not create. Check for hidden folders too, since the FBI notice names those along with external forwarding.
- Re-verify any supplier or carrier bank-detail change from the last 30 days by calling a phone number you already had on file. If a payment went out on an unverified change, call the bank today, and read my notes on setting up Mercury if you want alerts and approval rules on outgoing payments.
- Decide where business email should live. Google Workspace hosts domain email separately from your web host. Zoho is a second option that does the same.
- Turn on two-factor authentication for your registrar, Shopify, ad accounts and bank, and use an authenticator app rather than email codes. If you want a second set of eyes on your setup, Explore Turnkey Builds and we will walk through it.
If you are weighing a move off shared hosting, SiteGround is one I would price first. Cloudways is the other. I would not migrate in a panic over this news alone, because the real fix is separating mail, domain and hosting, and you can do that without moving the website.
Keep your domain at a registrar that is not your host, such as Namecheap. My registrar comparison shows the renewal and privacy differences, and a separate registrar means a host incident cannot also take your DNS.
Frequently Asked Questions
Does the DreamHost incident affect my Shopify store?
Not directly. Your Shopify store runs on Shopify’s infrastructure, but domain email, a blog or FTP files on DreamHost can still be affected. If you are still deciding what to sell, my free niches list is the place to start.
Was data stolen?
DreamHost has not said. BleepingComputer reports the company has not disclosed how many accounts were affected or whether files or messages were exposed.
Why can’t my team log in to email?
Affected passwords expired, and only the account owner can set replacements. DreamHost says it cannot contact individual mailbox or FTP users directly, so you have to hand out the new credentials yourself. If you decide to move mail off the host, my list of Gmail alternatives is a starting point.
Does a password reset remove forwarding rules?
The reporting does not say it does. DreamHost told owners to review forwarding rules and delete unfamiliar destinations, so check them by hand, the way I describe in my guide to protecting a high-ticket store’s security infrastructure.
Should I switch hosts?
Not on this news alone. Website hosting stayed up, and the cause is unconfirmed. If you do move, the cost of a clean setup is small next to a stalled order queue, and my write-up on hosting WooCommerce sites at scale covers what to ask a host.
How do I protect supplier payments from email fraud?
Call a known number before changing any bank details, and require a second approver for new payees. My guide to chargeback prevention for high-ticket stores covers the customer side of the same discipline.
Want 1-on-1 coaching to build a high-ticket store that does not break when one vendor does? Get the coaching details →
Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.
Related Articles
If this was useful, these go deeper:
- PHP Warns of a Third Flaw the PHP2Shell Patches Miss
- Railway Breach May Expose Store API Keys: Rotate Now
- Stolen UpdraftCentral Keys Backdoor WordPress Stores
- Unauthorized Google Certificates: Lock Your Store Domain
- How to Get a Business Address Without Renting an Office (2026)
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
