X Users Hit by Password-Reset Email Flooding

X is investigating a wave of unsolicited password-reset emails and codes being sent to users, which may be attackers trying to take over accounts as X Money becomes more available. X says it has found no evidence of a breach or successful account takeovers so far, but warns the reset-email “flood” could also help scammers hide phishing attempts among legitimate messages.

Key findings

• Users reported “unexpected password-reset emails and codes” starting September 1.
• X stated it has “no evidence of any breaches” and “no evidence of a breach or successful account takeovers so far.”
• The activity appears consistent with bulk password-reset requests (reset flooding), which can be used as cover for scams or to pressure users into unsafe actions.
• X Money’s rollout may increase attacker interest in X accounts, especially those with payments access or high-value influence.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Social media/communications teams, Finance teams, Customer support/helpdesk.
• Affected industries: Social media / online platforms, Financial services (embedded payments), Consumer internet services.
• Attack channels: email.
• Impersonated: X (account security / password reset system).

Awareness takeaways

• If you get an unexpected password-reset message, don’t click it, go directly to the app/site yourself.
• Never share password reset codes or MFA/2FA codes, even if someone claims to be ‘support’ or ‘security.’
• Treat alert ‘floods’ as a warning sign, attackers may be trying to hide a more serious scam in the noise.
• Enable stronger account protections (reset protection and 2FA) to reduce account-takeover risk.

Red flags to watch for

• You did not request a password reset but receive repeated reset emails/codes
• High volume of messages intended to create urgency and confusion
• Any request to share a reset code or 2FA code