- X is investigating a wave of unsolicited password-reset emails and confirmation codes reported by users.
- The company says it has found no evidence so far that its systems were compromised.
- The activity comes as X Money expands to U.S. Premium subscribers, potentially making accounts more attractive targets for attackers.
X is investigating reports of unexpected password-reset emails and confirmation codes being sent to users, raising concerns about possible attempts to gain unauthorized access to accounts.
Mridul Singhai, who works on X’s Product Engineering team, said Tuesday that the company is looking into the activity but has found no evidence that X itself suffered a security breach.
Multiple users reported receiving password-reset requests despite never initiating them.
The activity has led to warnings that users should avoid clicking links contained in unexpected emails and instead access their accounts directly through X’s official app or website.
X Says Its Systems Were Not Compromised
While the volume of password-reset emails initially raised concerns about a broader breach, X’s investigation has not found evidence that attackers gained access to its internal systems.
The activity could instead involve attempts to trigger legitimate password-reset mechanisms for targeted accounts.
Users have been encouraged to enable two-factor authentication and X’s “Password reset protect” feature, which adds another layer of verification before a password can be changed.
Unexpected verification codes should also not be shared with anyone.
X Money Could Make Accounts More Attractive Targets
Singhai suggested attackers may believe the expanding availability of X Money creates additional opportunities for compromising accounts.
X recently rolled out X Money to all Premium and Premium+ subscribers with U.S. accounts.
The service allows eligible users to send money to one another directly through X using banking infrastructure provided by Cross River Bank.
Connecting financial capabilities more closely with social accounts could increase the potential value of successfully compromised accounts, making account security increasingly important as X Money expands.
Users Urged to Strengthen Account Security
For now, X has not confirmed that the password-reset activity resulted from a breach.
Users receiving unsolicited reset emails should avoid interacting with links inside the messages and verify any account activity directly through X.
Enabling two-factor authentication, strengthening passwords and activating password-reset protection can provide additional safeguards against account takeover attempts.
The investigation comes at an important time for X as the platform expands beyond social media and deeper into financial services through X Money.
