A password reset locks out whoever holds the old password. It does nothing about the rule that quietly copies every email to somewhere else.

On the afternoon of 23 October, web host DreamHost began investigating problems with its File Manager. Within hours, Help Net Security reports, the incident had spread to several services: File Manager was taken offline, some webmail users were signed out, and by that evening the company was resetting passwords for a subset of email and FTP/SFTP accounts “as a precaution”. The resets finished on 24 October, and a fix restored File Manager on 26 October, though email hosting and webmail were still listed as disrupted. DreamHost has not said what caused the incident or how many customers are affected. SecurityWeek, which has asked DreamHost for the root cause, quotes the notice to account owners: only the owner can set new passwords, DreamHost “is unable to contact individual mailbox or FTP users directly”, and “if they used the old password anywhere else, they should change it there too.” CyberInsider reports that the customer notice also recommends checking email forwarding settings and removing any unfamiliar destinations. DreamHost, which says it serves more than 400,000 customers in over 100 countries, warns that it will never email anyone asking for their password.

That forwarding advice is the part we should all take note of, whatever the cause turns out to be. A mailbox forward or rule is persistence that sits outside the password: reset the credential and the copy keeps flowing. And notice the notification chain. The provider can reach the account owner, not the people using the mailboxes, so the person who needs to act may never hear about it. In APAC, plenty of regional offices, subsidiaries, agencies and acquired brands still run email on shared hosting, well outside the corporate tenant your team monitors. Those mailboxes receive password resets, invoices and supplier mail like any other. If you don’t know they exist, you can’t check their rules.

What security leaders should do:

• Inventory every domain and mailbox your organisation sends from, including those on shared hosting run by marketing, subsidiaries or partners, and name an owner for each.
• After any provider-forced reset, audit forwarding addresses, inbox rules and app passwords on the affected mailboxes, not just the credential.
• Treat reused passwords as exposed: if a hosting mailbox password was used elsewhere, rotate it there too, as DreamHost advises.
• Warn users to expect fake reset and “action required” emails after a public incident; send people to the provider’s panel directly, never through a link.
• Make sure provider security notices reach a monitored shared address, not one person’s inbox.

Resetting the password closes the front door. Checking the forwarding rules tells you whether anyone left a window open.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#EmailSecurity #IdentitySecurity #IncidentResponse #APAC #CyberSecurity

Sources: Help Net Security · SecurityWeek · CyberInsider