X Users Flooded With Unrequested Password Reset Emails

X users have been receiving password reset emails they did not request on September 1, with some also reporting unfamiliar login alerts and temporary account lockouts.

The emails are legitimate and were sent through X’s own systems. However, X has stated it has found no evidence of a new data breach. X engineer Mridul Singhai said the company is investigating this activity and believes attackers may be trying to gain control of accounts, particularly as X Money becomes more widely available.

Security researchers have pointed to several possible sources for the activity, including a 2022 Twitter API vulnerability that exposed information connected to more than 200 million users. A separate dataset containing 201 million X user records was also posted online in 2025. Researchers have also identified an active botnet testing stolen credentials against X accounts.

At the same time, a phishing campaign targeting X users has been running since July. The emails imitate X’s legitimate login alerts and direct recipients to fake pages designed to steal passwords or authorize malicious applications.

Sumsub’s own X account has also experienced the password-reset activity, adding to the reports from users and organizations seeing unexpected messages from the platform.