Unsolicited Password Reset Emails Plague X Users Amid Security Concerns
X users have been inundated with unsolicited password reset emails over the past several weeks, with a significant surge occurring today. The platform is also experiencing login alerts from unfamiliar locations, and some users report being temporarily locked out of accounts they haven’t accessed in weeks.
These password reset emails are legitimate, originating from X’s own systems, but they are being sent to account owners who did not request them, sparking widespread concern.
Echoes of Past Breaches and Emerging Threats
The situation bears a striking resemblance to a scare faced by Instagram users in January, when unrequested reset emails coincided with the appearance of a dataset containing 17.5 million accounts on a dark-web forum. Meta at the time attributed the issue to a bug that allowed external parties to trigger the emails, while denying any breach of its own systems.
X has not publicly acknowledged a recent breach, but the company is aware of the ongoing problem. In a recent tweet, X engineer Mridul Singhai apologized for the inconvenience, stating that the company is not aware of any new breaches and that hackers appear to be targeting X accounts to gain access to “X money.”
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” Singhai wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches.”
Datasets and Botnet Activity Fueling Attacks
The current wave of emails may be linked to a years-old vulnerability in Twitter’s API that allowed an attacker to match email addresses and phone numbers to accounts in January 2022. A dataset derived from this exposure, covering over 200 million users, is now cataloged on Have I Been Pwned.
Compounding the issue, a hacker known as ThinkingOne posted a 34-gigabyte file in April 2025 containing 201 million X user records—including screen names, email addresses, account creation dates, and follower counts—on the BreachForums platform. Researchers have confirmed that the emails in this dataset match active X accounts.
Neither of these datasets requires a fresh hack to remain a threat. The circulating email addresses are being utilized in two ongoing operations. Researchers at Breakglass Intelligence discovered an unsecured command-and-control panel in April 2026 that was actively testing stolen credentials against X accounts, confirming 18 new compromises within a 12-minute window. Over its operational lifetime, the botnet had tested more than 4.8 million X accounts, with two-factor authentication blocking 85.6% of these attempts.
Phishing Campaigns and Proton Mail Disruptions
Separately, a phishing campaign unrelated to any data breach has been targeting X users since July. Scammers are sending emails that closely mimic X’s legitimate “new device login” alerts, complete with the correct logo and grammar. These emails prompt recipients to click a link to secure their account, leading to fake pages designed to steal passwords or authorize malicious applications.
Some X users have also reported experiencing unsolicited reset activity on Proton email services around the same time. Proton has acknowledged the disruption and is investigating the issue.
While neither Proton nor security researchers have confirmed a direct link, users who employ Proton Mail for their X accounts should be aware of the potential implications.
X’s Security Measures and User Recommendations
X’s help documentation confirms that the platform proactively resets passwords for accounts flagged as compromised or targeted by phishing, sending an email to the registered address with instructions. If such an email arrives without your request, it suggests that your credentials may have already been targeted or that you have been subjected to a phishing attempt.
X advises users to verify sender addresses, as the company only emails from @X.com or @e.X.com and never requests passwords via email. Users are also encouraged to enable two-factor authentication using an authenticator app, employ a unique password for X, and regularly review their account’s active sessions and connected applications for any unfamiliar activity.
A crucial security step recommended by X is to enable the “password reset protect” option within the “security and account access” settings. This adds an extra layer of verification, requiring confirmation of the associated email address before a password reset request can be processed.
Users are also cautioned against contacting individuals offering unsolicited help, as these are often scams that prey on users mentioning specific keywords or seeking assistance with security topics.
Proton Mail Service Disruption
Proton’s status page reported a service disruption on September 1, attributing it to residual hardware failures from an overheating incident the previous week and reduced capacity during infrastructure upgrades. While this disruption is not connected to the X activity, it could potentially delay the delivery of any necessary reset emails to Proton Mail users.
By the time researchers took down the April botnet’s control panel, it had confirmed 138 account compromises out of 4.8 million attempts. While this represents a small fraction, it is significant when multiplied across the billions of credential-stuffing attempts estimated to target login pages globally each month.
