The ongoing security incident at DreamHost highlights an important cybersecurity challenge: protecting hosting infrastructure requires much more than securing the websites running on it.

DreamHost, which supports more than 1.5 million websites and applications, has initiated mandatory password resets for certain email and FTP/SFTP accounts following disruptions affecting its hosting services. The company has also advised customers to examine email forwarding rules for unauthorised changes. Although the full nature of the incident remains under investigation, these precautionary measures raise important questions about credential security and access monitoring.

What makes hosting credentials particularly sensitive is the level of access they can provide. An email account may contain confidential business communications, while FTP/SFTP credentials may provide access to website files, application configurations and potentially sensitive information. Depending on the permissions assigned, compromised credentials could allow attackers to modify website content, retrieve files or establish additional access.

Changing passwords is an essential security measure, but it does not necessarily address everything that may have occurred before the reset. Organisations must also review authentication logs, unexpected file modifications, suspicious email forwarding rules and unusual data transfers. If credentials were misused, simply changing them would not reverse any unauthorised actions already performed.

This incident also highlights why identity-aware security and Contextual Data Loss Prevention are increasingly important. A user accessing a website's files or downloading business information may appear legitimate when valid credentials are used. However, unusual access patterns, unexpected destinations or large transfers of sensitive information may indicate activity that requires further investigation.

At GajShield, we believe effective cybersecurity requires combining network protection, application and API security, identity-aware monitoring and Contextual Data Loss Prevention. These complementary controls can help organisations identify suspicious behaviour, restrict certain unauthorised data transfers and reduce the consequences of compromised credentials.

The broader lesson from the DreamHost incident is that organisations must treat hosting accounts, email services and file-transfer credentials as critical security assets, not merely administrative conveniences.

A password reset can restore control over an account, but continuous monitoring is essential to establish whether that account was previously misused.

Because securing your website is important, but securing every identity and service that can access it is equally important.

DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]

Source: DreamHost forces password resets in ongoing "incident" via Bleeping Computer — published 26 Oct 2026.