X is investigating a surge of unsolicited password reset emails sent to users, which the company believes is linked to the September 2026 launch of its new payments service, X Money.
On Tuesday, September 1, 2026, X product engineer Mridul Singhai posted on the platform that the company was actively looking into user complaints about the mass password reset attempts. “Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” he wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”
X Money is X’s newly launched payments service, which includes a bank card and other benefits. The service is designed to make it easier for creators to collect payments on the platform. X says the financial nature of the service may be what is drawing bad actors to target user accounts.
X general counsel James Burnham also posted a response, stating that X’s legal and security teams “will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform’s users.” As of publication, X had not issued a statement through any official company account and had not responded to press inquiries.
X’s AI chatbot Grok has been responding to affected users with instructions on enabling two-factor authentication, and confirmed that attackers are “mass-triggering” the password reset form using public usernames. Grok noted there have been “no confirmed system breach or mass takeovers.”
Users have also been warning each other about the attacks and urging those who have not yet enabled two-factor authentication to do so. The incident highlights the security risks that may accompany the rollout of financial services on social media platforms, as money changing hands could attract further attempts to compromise accounts.
Source: TechCrunch