X says it is investigating a wave of unsolicited password reset emails sent to users following the wider launch of X Money. The company has not found evidence that attackers successfully breached accounts, but an X engineer said attackers appear to be targeting users because the platform now includes financial services.
X product engineer Mridul Singhai said Tuesday that the company was reviewing complaints about repeated password reset attempts. He said attackers appeared to believe that access to X accounts had become more valuable after X Money became widely available.
Attackers Appear to Be Triggering Password Resets
Singhai said X had not found evidence of successful breaches as of Tuesday. He apologized for the repeated emails and said the company was continuing to investigate the activity.
X Money is the platform’s recently launched payments service, which includes a bank card and other financial features. The service is also intended to make it easier for creators to receive payments through X.
X had not published details about the incident through one of its main company accounts at the time of reporting. The company had also not publicly provided information about how many users received password reset emails or how long the activity had been occurring.
X general counsel James Burnham said the company’s legal and security teams would work to identify and pursue people attempting to target users. His comments came as users began warning one another about the password reset emails.
X Says No Mass Account Takeovers Have Been Confirmed
X users have also been encouraging others to enable two-factor authentication as an additional account protection measure. The platform’s Grok chatbot has responded to some of those discussions with instructions for enabling the feature.
Grok said attackers appeared to be “mass-triggering” X’s password reset form using publicly available usernames. The chatbot also said there was no confirmed system breach or evidence of widespread account takeovers.
X has not said whether the password reset attempts are directly connected to the infrastructure supporting X Money or whether attackers are simply targeting ordinary X accounts following the payment service’s launch. The company’s investigation remained ongoing as of Tuesday.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.