X Investigates Mass Password Reset Surge Targeting X Money

Users of the social media platform X reported a surge of unrequested password reset emails on September 1, 2026, with some receiving more than 10 messages in a single morning. While the emails originated from legitimate X systems, users also reported temporary account lockouts and login alerts from unfamiliar locations.

X Product Engineer Mridul Singhai stated the company is investigating the activity and has found no evidence of a new system breach or mass account takeovers. Singhai attributed the surge to attackers mass-triggering the account recovery system using public usernames to gain unauthorized access, specifically to exploit X Money, a payment platform for Premium subscribers launched in July.

Security researchers suggest the activity may be linked to older data exposures, including a 2022 API vulnerability and a 2025 leak of 201 million records. A separate botnet utilizing stolen credentials was also identified as targeting accounts earlier in the year. X General Counsel James Burnham warned that the company will seek to hold attackers criminally accountable, while the company recommended that users enable two-factor authentication and password reset protection.

Simultaneously, the email service Proton reported a disruption in connectivity. However, Proton attributed the outage to hardware failures resulting from a previous overheating incident rather than the activity targeting X.