X Users Report Unrequested Password Reset Emails Amid Security Concerns

X users have been experiencing a surge of password reset emails that they did not request, causing significant concern among the community. This issue has been particularly pronounced in recent weeks, with many users reporting login alerts from unfamiliar locations and some even being temporarily locked out of their accounts. The reset emails are confirmed to be legitimate, originating from X's own systems, but they are being sent without user initiation, which has left many feeling anxious about their account security.

In a recent tweet, X engineer Mridul Singhai addressed the situation, stating that while the company is aware of the issue, they have not identified any new breaches. Singhai noted that hackers appear to be attempting to gain control of X accounts, particularly in light of the availability of @XMoney, which has heightened the stakes for unauthorized access attempts. The company is actively investigating the matter, but as of now, no evidence of a breach has been found.

This situation may be linked to older vulnerabilities that have resurfaced. For instance, a flaw in Twitter's API discovered in January 2022 allowed attackers to match email addresses and phone numbers with accounts, resulting in a dataset of over 200 million users being cataloged on Have I Been Pwned. Additionally, a hacker known as ThinkingOne posted a 34-gigabyte file containing user records on BreachForums in April 2025, which included sensitive information such as screen names and email addresses.

Researchers have also identified a botnet that has been testing stolen credentials against X accounts, confirming several compromises. This botnet has processed millions of accounts, with two-factor authentication successfully blocking the majority of unauthorized access attempts. Furthermore, a phishing campaign targeting X users has been ongoing since July, with scammers sending emails that closely mimic legitimate login alerts, tricking users into providing their credentials.

Some users have reported similar unrequested reset activity on the Proton email service, which has also acknowledged service disruptions. While no direct link has been confirmed between the two incidents, users are advised to remain vigilant, especially if they use Proton for their X accounts.

X's help documentation indicates that the platform proactively resets passwords for accounts flagged as compromised or targeted by phishing. If users receive a reset email without requesting it, it may indicate that their credentials have been attempted by someone else. To enhance security, users are encouraged to check the sender's address, ensure they are using unique passwords, and enable two-factor authentication through an authenticator app.

Additionally, users should be cautious of unsolicited offers for help, as these often lead to scams. X advises users to check their account settings for any unfamiliar activity and to utilize the 'password reset protect' feature to add an extra layer of security against unauthorized reset requests. As the situation develops, users are urged to stay informed and take necessary precautions to safeguard their accounts.