X blocks password-reset attack targeting hundreds of thousands of users

Sep 1, 2026 14:14 (21d ago)

X blocked a password-reset attack targeting hundreds of thousands of users and prevented account hijackings.
Attackers repeatedly submitted public usernames through X’s recovery form, generating unsolicited emails during the X Money rollout.
Attorney General Todd Blanche said the Justice Department is working with X to identify and track the attackers; X reports no evidence of a new breach.

X blocked a password-reset attack targeting hundreds of thousands of users this week, preventing account hijackings, while continuing to investigate waves of unsolicited reset emails generated through its recovery form. The activity coincided with the rollout of X Money and involved attackers repeatedly submitting public usernames, but X has reported no evidence of a new systems breach or confirmed mass takeover. U.S. Attorney General Todd Blanche said the Justice Department is working closely with X to identify and track the cybercriminals, while X urged users to enable Password Reset Protect and two-factor authentication.