X probes password reset wave targeting accounts after X Money launch
Following the rollout of X Money, X users are receiving unsolicited password reset emails; the company says it has found no evidence of breaches yet.
X says it is looking into a wave of unsolicited password reset emails that hit many users after the launch of its new payments service, X Money. The social media company has not confirmed any successful intrusions, but attackers appear to be trying to gain unauthorized access to accounts.
On Tuesday, X product engineer Mridul Singhai wrote on the platform that the company was investigating complaints about mass password reset attempts. He said attackers seem to believe that now that X Money is widely available, they can access accounts without permission. Singhai added that there was no evidence of breaches so far and apologized for the multiple emails sent to users.
X Money is X’s newly launched payments offering, which includes a bank card and other benefits. The service is seen as a way for creators to more easily receive payments on the platform, further supporting X’s digital economy. The involvement of money often attracts malicious actors, and X suggests that may be what is happening.
At the time of writing, X had not posted details on its official corporate accounts and had not responded to a press inquiry. However, X general counsel James Burnham issued a stern warning, stating that the legal and security teams would stop at nothing to identify, locate, and hold criminally accountable anyone who attempts to victimize users of the platform.
As the situation continues, users are alerting each other and reminding one another to enable two-factor authentication if they have not already done so. X’s chatbot Grok has also responded to some posts with instructions on how to enable the feature. Grok confirmed that attackers are mass-triggering the password reset form using public usernames, but noted there have been no confirmed system breaches or mass takeovers.
