X users report surge in unsolicited password reset emails, prompting security warnings.
Regulation & Gov ·
Thousands of X users received unexpected password reset emails on Tuesday, including crypto industry figures and staff members, sparking concerns about a potential account-takeover attempt. Some users reported receiving as many as 10 emails within hours. Crypto investor Nic Carter publicly warned others to activate X's Password Reset Protect feature, while another user noted unsuccessful reset attempts despite having two-factor authentication enabled. At least four staff members at the news outlet similarly reported the unwanted emails on the same day.
The influx does not automatically signal a system compromise. X's mechanics allow anyone to initiate a password reset using a public username; the platform then sends the reset link to the associated email address. The Password Reset Protect setting adds a verification step, requiring confirmation via email or phone. Notably, some staff members whose associated email addresses were not publicly known also received the emails, though this alone does not confirm attackers accessed private contact data.
X has not publicly acknowledged the incident or commented on whether a coordinated campaign occurred. No evidence of a breach or widespread account takeovers has emerged so far. The platform previously suffered large-scale data exposure in 2021 when an API vulnerability exposed email addresses and phone numbers for over 200 million accounts; it remains unclear whether Tuesday's wave relates to that earlier incident.