- X is investigating unauthorized password reset requests reported by multiple users.
- An X representative said attackers may be seeking account access amid the expansion of X Money, but the company has found no evidence of a breach.
- X advised users to enable two-factor authentication and Password Reset Protection and avoid links in suspicious messages.
Mridul Singhai, a representative of X’s product development team, said on Sept. 1, 2026, that the social network was investigating a wave of unauthorized password reset requests amid the expansion of its X Money payments service. The investigation followed reports from users who received multiple password reset emails and verification codes that they had not requested, raising concerns about attempted account access.
Singhai said attackers appear to believe they can gain unauthorized access to accounts now that @XMoney is widely available. “We are actively investigating this issue and, so far, have found no evidence of any breaches,” Singhai said in a post. He also apologized for the multiple emails and thanked users for their patience.
Password reset requests
According to user reports, attackers may be triggering X’s password recovery process at scale by using publicly available account usernames. Receiving a password reset email does not mean that a user’s password has been exposed or that the account has been compromised.
X chief legal counsel James Burnham also responded to the incident. He said the company’s legal and security teams intend to identify those attempting to attack platform users and pursue accountability.
X recommended that users enable two-factor authentication and its Password Reset Protection feature, which requires additional information during an attempt to recover a password. The company also advised users not to click links in suspicious messages.
As of the time of the report, X had not published a separate statement about the incident through its official corporate accounts. Company representatives continued to say they had found no signs that X’s infrastructure had been compromised or that accounts had been taken over on a mass scale.
X Money expansion
The password reset activity coincided with the expansion of X Money. The payments service became available to U.S. account holders with Premium and Premium+ subscriptions, allowing eligible users to send money directly to other users through the X platform.
U.S. Sen. Elizabeth Warren had previously raised concerns about the launch of X Money.
Source: Incrypted
