X experienced a large-scale “password reset” email incident on September 1, with numerous users receiving official password reset verification emails without having requested them. Some users received as many as 10 emails within just a few minutes. X engineer Mridul Singhai said the company is actively investigating the incident and has so far found no evidence that any system was compromised. X apologized for the incident.
X Password Reset Emails Trigger Widespread Concern
The incident quickly spread across social media on September 1, 2026, and also affected people in the cryptocurrency industry. Star, founder of the Day1Global Podcast, said he received 10 consecutive X password reset emails and was concerned that his account might be under a lockout attack. Hsu Ming-en, founder of Blocktrend, shared a screenshot of his Gmail inbox showing multiple “password reset requests” from X arriving within a short period. The emails were indeed sent by X’s official system rather than being externally spoofed phishing emails. However, receiving these emails does not itself indicate that an account has been compromised, nor does it prove that an attacker has obtained the user’s email address.
Root Cause: X’s Password Recovery Process Allows Public Usernames to Trigger Resets
X’s password recovery process allows users to enter an email address, phone number, or public X username to request a password reset. The system then sends the reset information to the email address linked to the account. Because X usernames are public information, attackers can collect large numbers of account names and submit reset requests in bulk through the official password recovery function. Once X’s system receives the requests, it automatically sends the actual reset emails to the account holders. This means that attackers only need to know a public X username to trigger the process; they do not need to know the user’s email address. Completing a password change still requires access to the email address, phone number, or other verification information linked to the account. This wave of mass emails currently appears to be more consistent with large-scale abuse of the password recovery mechanism, with no evidence so far that X’s database or internal systems were compromised.
X Engineer: System Was Not Compromised
X engineer Mridul Singhai said the company is actively investigating the incident and has so far found no evidence that any system was compromised. X also apologized for the disruption caused by the large volume of password reset emails. Singhai added that as X Money’s financial services become more widely available, attackers may believe that gaining unauthorized access to X accounts could bring greater economic benefits, prompting them to make more active attempts to take control of user accounts.
This speculation has drawn particular attention from the cryptocurrency community. X is one of the most important social platforms in the crypto industry, and high-profile accounts themselves have considerable value as attack targets. With the addition of financial functions such as payments and transfers, the potential losses caused by account takeovers could increase further. A direct connection between this incident and the past Twitter API vulnerability that resulted in the leak of 200 million account records has yet to be confirmed.
Official Recommendation: Enable “Password Reset Protection” to Reduce the Risk of Public Usernames Being Abused
In response to this incident, users can take the following protective measures:
· Go to X “Settings” → “Security”and enable“Password Reset Protection”: Once enabled, the system requires the requester to additionally enter the email address or phone number linked to the account, making it more difficult for outsiders to use a public username to trigger a reset.
· Use a unique, strong password and avoid reusing the same password on other websites.
· Enable two-factor authentication (2FA) to add an extra layer of verification.
· Check the account’s current login sessions and connected third-party applications to see whether any unfamiliar devices or unusual approvals appear.
· When receiving related emails, avoid clicking links whose source cannot be directly verified. Confirm that the website is x.com before entering your account password.
Frequently Asked Questions
Does suddenly receiving an X password reset email mean that the account has been compromised?
According to X engineer Mridul Singhai, no evidence of any system being compromised has been found so far. These emails were indeed sent by X’s system. The root cause is that the password recovery mechanism allows public usernames to trigger reset requests, enabling attackers to trigger the process in bulk without knowing users’ email addresses.
Why can attackers trigger large numbers of password reset emails?
X’s password recovery process allows users to initiate a reset request by entering an email address, phone number, or public X username. Because usernames are public information, attackers can collect large numbers of account names and submit requests in bulk, after which X’s system automatically sends reset emails to the account holders.
After receiving a password reset email, what is the most important protective measure?
X officially recommends enabling the “Password Reset Protection” feature. Once enabled, the system requires the requester to additionally enter the email address or phone number linked to the account, making it more difficult for outsiders to use a public username to trigger a reset. Users are also advised to enable 2FA and check their account’s login sessions and third-party approvals.
