Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying...

"As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set."

But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted?

The same email suggests you change all email passwords you control.

Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email.

My complaints:

- sucks that it took them 48 hours to identify the breach - perhaps understandable

- but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible.

- confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety).

I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.