For emails over 7 rolling hours, unless you're e.g. Google or Microsoft, you kinda have to, otherwise those systems will automatically shadowban (send-to-spam) you for excessive/abnormal email sending rates. It's not great.
It also doesn't help that a lot of scammers use this, or fake cyber incidents, for phishing; so it's not like they have an easy solution for exempting "security emails" either.
Sure, but it also took them 7 hours to email their own customers on the email infrastructure run by DreamHost themselves. Since they run the IMAP and SMTP servers, seems like they could have done that in seven seconds.
Of course, if they are nuking everyone's email password that doesn't help for notification purposes -- but as of this morning, all my email logins are still working fine, so it seems they didn't actually do that? Confusing.
Yeah. And if it's not all passwords under the account, the email should've had a list of the affected ones. Instead Dreamhost says both that they've already deleted the at risk passwords, and also that customers need to reset all passwords. Maybe when they mean "reset all" they meant "reset all [the deleted] passwords", but being so unclear about scope and remediation steps is a painful mistake.
A single sentence like, "If a password wasn't reset as of (timestamp), we don't believe it could have been at risk." would go a long way to fixing these incident comms, if that's the case.
Agree. And this is all made worse by the fact that there seems to be a bug in iCloud keychain syncing - I can change the password on my mac, verify it works, but when I go over to iPhone or iPad, the old password is still being used. Not sure if there's a way to force the sync process on both ends?
It also doesn't help that a lot of scammers use this, or fake cyber incidents, for phishing; so it's not like they have an easy solution for exempting "security emails" either.