X Money rollout linked to password-reset attacks
Brief
X says attackers may be targeting accounts because its X Money payments service is now more widely available.
The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X says it has found no evidence of a breach or successful account takeovers so far.
X users began reporting unexpected password-reset emails and codes on September 1. In a public post, X product engineer Mridul Singhai said :
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts.”
Singhai said X was actively investigating, apologized for the repeated emails, and added that the company had found “no evidence of any breaches.”