X users are facing unsolicited password reset emails, raising security concerns over potential account vulnerabilities and phishing attempts.
Security Concerns Emerge for X Users
Starting in early August, users on X have reported receiving unsolicited password reset emails, unexpected login alerts, and even account lockouts. This troubling trend has intensified recently, causing significant alarm among the platform's user base.
While X has not confirmed any new data breaches, cybersecurity experts suggest that these incidents may be linked to an outdated vulnerability in the platform's API from 2021-2022, coinciding with a dataset leak involving 201 million records in 2025. Additionally, a botnet and an active phishing campaign that began in July could be contributing to these issues.
Unsolicited Emails and Account Lockouts
The unrequested emails, although genuine and sent from X's systems, have raised concerns, particularly as some users have reported being locked out of their accounts. One user expressed on social media their unease, stating, "Someone has been trying aggressively to reset my X password... I have 2FA but I’m still on edge."
This incident is reminiscent of a similar occurrence with Instagram earlier in the year, where users received unexpected password reset emails following a dataset exposure.
Investigations into Potential Vulnerabilities
Mridul Singhai, an engineer at X, acknowledged the disruptions and clarified that no new breaches have been detected, indicating that attackers might be trying to exploit vulnerabilities for unauthorized access to user accounts for financial gain. The resurgence of an older flaw in the API is suspected to be enabling these incidents, with previous data leaks exposing vast numbers of user details.
Cybersecurity researchers have observed that an unsecured command-and-control panel was actively testing stolen credentials against X accounts, further complicating the security landscape for the platform. Two-factor authentication has managed to thwart a significant number of unauthorized access attempts.
Phishing Campaigns and Email Service Disruptions
A separate phishing scheme has targeted X users since July, with scammers sending emails that mimic X's legitimate communications, urging users to click links that potentially compromise their accounts. At the same time, Proton, a third-party email recovery service utilized by some X users, has been facing disruptions, further complicating the recovery process for affected users.
Recommendations for Users
In light of these security issues, users are advised to be vigilant. X has detailed recommendations for safeguarding accounts, which include verifying the sender's email address, using unique passwords, enabling two-factor authentication via an authenticator app, and reviewing active sessions for any suspicious activity.
To enhance account security, users should also activate the "password reset protect" option in their account settings. X has stated that it never requests passwords via email, making it crucial for users to be cautious regarding unsolicited communications.
Proton has acknowledged its service disruptions and is currently working on resolving the issues affecting its users. Keeping abreast of the situation is essential for X users, especially as these security challenges continue to evolve.
