X platform targeted by massive password-reset spam attack

The social media platform X experienced a massive wave of unauthorized password-reset requests targeting hundreds of thousands of user accounts starting on September 1, 2026. Attackers reportedly used publicly available usernames to trigger automated emails, attempting to gain unauthorized access to accounts.

U.S. Attorney General Todd Blanche confirmed the coordinated attack on the password-recovery functions but noted that X successfully interrupted the wave by September 2. Both the Department of Justice and X developers, including Mridul Singhai, stated there is currently no evidence that internal databases were breached or that any accounts were successfully compromised.

Analysts suggest the timing of the attack may be linked to the recent launch of X Money, a financial service allowing users to conduct transactions and earn interest on balances. X recently announced it would transition payouts for U.S.-based creators from Stripe to X Money. The expansion into financial services has drawn criticism from U.S. Senator Elizabeth Warren, who previously warned of potential risks to consumer protection and financial stability.