Over the weekend, web hosting provider DreamHost suspended its File Manager service and reset some user passwords.
The company says it took protective actions in response to “an issue” with its systems, which affected File Manager at files.dreamhost.com and DreamHost webmail.
“As a precaution, we are resetting passwords for some email and FTP/SFTP users,” the company warned on Friday.
It also notified DreamHost account owners via private communication (shared on Reddit), noting that users would need to set new passwords when logging in, and underlining that DreamHost would not request password resets via email.
“We are contacting you because you are the DreamHost account owner, and only you will be able to set new passwords for these users. DreamHost is unable to contact individual mailbox or FTP users directly, so they may not know about this until you tell them,” the company said.
“If they used the old password anywhere else, they should change it there too,” DreamHost told account owners.
Users complained about DreamHost’s lack of transparency, and some speculated that the passwords may have been compromised and questioned whether they were properly hashed.
In the meantime, DreamHost says it has created and deployed a fix to the File Manager and restored access to http://files.dreamhost.com.
“We are monitoring the situation to ensure that the File Manager is back in a fully operational state,” the company said on Monday.
SecurityWeek has emailed DreamHost for information on the number of affected users and the root cause of the incident and will update this article if the company responds.
Related: Genesys Hack Exposes Customer Data From Internal Systems
Related: 11 Million Impacted by Capcom Data Breach
Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
