X is investigating a wave of unsolicited password reset emails that users reported after the launch of its new payments service, X Money. A company representative said the social media platform was actively looking into the issue but had not yet found evidence that any accounts had been successfully compromised.
On Tuesday, X product engineer Mridul Singhai posted on the platform: “Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts. We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”
X Money is the company’s newly launched payments service, which includes a bank card and other benefits. The service could make it easier for creators to collect payments on the platform, but it has also attracted bad actors, according to X.
X general counsel James Burnham warned that the legal and security teams “will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform’s users.”
Users have been advising each other to enable two-factor authentication to protect their accounts. X’s chatbot Grok has also replied to some posts with steps on how to do so, while confirming that attackers are “mass-triggering” the password reset form using public usernames. Grok added: “No confirmed system breach or mass takeovers.”