The company nevertheless decided to reset all FTP and shell user access passwords for all Dreamhost users. This should not be confused with the account password used to log into the Dreamhost site itself though. Dreamhost customers who are using the same passwords for multiple services should change passwords on all of them to eliminate the possibility of unauthorized access to those accounts.

Dreamhost furthermore notes that users should also be changing email passwords of all Dreamhost managed email addresses as soon as possible.

We have been sending out update emails to every account owner we have, letting them know what happened, and how to proceed from here on out. As a precaution, we advise every user to change all email passwords as well. We are not forcing this change, however, so make sure you take care of that ASAP.

Shell and ftp passwords can be changed in the Manage Users interface which is accessible here. Dreamhost customers need to click on the edit button next to the ftp or shell user to change the log in password for that account.

A company representative noted that neither credit card data nor web panel logins were accessed by the attackers. If you read through all of the 270 or so comments on the Dreamhost blog, you will notice that many customers were quite infuriated about the level of information they received. Web panel access was not available at all times due to users trying to change their passwords, and rumors spread that Dreamhost was storing passwords in plain text (which was later refuted by a Dreamhost employee who stated that they were hashed).

Lets take a look at what Dreamhost customers need to do right now:

• Log into the web panel and change FTP, SFTP, MYSQL, Email and other account passwords. Some passwords have been reset automatically by Dreamhost which means that they need to be changed anyway to regain access.
• Change passwords on other accounts if the same password was used for access.

Passwords with a reasonable length should be safe, but it is nevertheless better to make the changes to be certain that the attackers cannot use successfully decrypted passwords to gain account or service access. A password manager like KeePass can aid in the creation of secure passwords.

Are you a Dreamhost customer? If so, when did you receive notification about the security incident and what did you experience afterwards?

I quickly contacted Sarah Perez who is in charge of the website and she told me the following. Her websites are all hosted at Dreamhost who closed down the account because of disputing credit card charges which Sarah had nothing to do with.

Now the funny thing is that you can only get the Dreamhost account access back if you send them a money order or check by postal mail for the amount of the chargebacks. The mail goes to a postbox address that Dreamhost seems to check twice a week.

Imagine that. You are a business owner and need your website and they check the frigging postbox twice week adding to the waiting time.

Support is unreachable it seems. She put in four support tickets and one complaint and tried to phone them but is only receiving voicemail. She cannot reach them no matter what she tries.

I hope everything sorts out soon. Things like that can throw a business back several months.

I wonder why all those companies shoot first. It would be so much better if they at least tried to contact the owner of the account before going on a rampage.