X is investigating reports of attackers targeting user accounts after the launch of X Money. Users have reported receiving unsolicited password reset emails. A representative stated that the company is actively looking into the issue but has not found evidence of successful hacks.
On Tuesday, X product engineer Mridul Singhai addressed user complaints about the mass password reset attempts on the platform. He stated, "Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts. We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this."
X Money is a newly launched payments service that includes a bank card and other benefits, aimed at facilitating payments for creators on the platform and enhancing X's digital economy. The launch has seemingly attracted malicious actors, according to the company.
As of the time of writing, X has not provided details on its official accounts and has not responded to press inquiries regarding the issue. However, X's general counsel, James Burnham, stated, "The legal and security teams @X will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform’s users."
In response to the ongoing attacks, users are advising each other to enable two-factor authentication to protect their accounts. X’s chatbot Grok has also provided guidance on this issue, confirming that attackers are "mass-triggering" password reset forms using public usernames. Grok stated, "No confirmed system breach or mass takeovers."
The widespread wave of unsolicited password reset emails is affecting many accounts. Users are advised to enable Password Reset Protect in their security settings.