Users of Platform X, formerly known as Twitter, have reported an unusual influx of unsolicited password reset emails over the past few weeks, with a significant spike in occurrences on September 1, 2026.

In addition to account recovery messages, there are reports of login alerts coming from unknown locations. Some users also reported being blocked from accessing their accounts that had been inactive for a period of time.

The password reset messages are authentic and come from official X systems. The legitimacy of these emails, despite not having been requested by the account holders, generated a wave of panic among users.

This scenario is not unprecedented. In January, Instagram users experienced a similar situation when unsolicited reset emails emerged just hours before the discovery of a dataset of 17.5 million accounts on a dark web forum. Although Meta confirmed a bug that allowed third parties to trigger these emails, the company denied any breaches in its own systems during that period.

Historical vulnerabilities affecting X security

Platform X did not acknowledge or disclose any recent breach, but confirmed that it was aware of the occurrence. In a post on X itself, engineer Mridul Singhai apologized for the inconvenience and stated that there was no evidence of a new attack, suggesting that attackers were trying to take control of accounts in search of access to X Money.

The recent spate of emails may be linked to an old data exposure that has resurfaced. In January 2022, a flaw in Twitter’s API allowed an attacker to connect emails and phone numbers to accounts. The dataset, which affected more than 200 million users, was listed on the Have I Been Pwned service, and Troy Hunt, the site’s founder, found that the majority (98%) of these addresses had already been compromised in previous incidents.

The situation worsened with the discovery of a more recent file. In April 2025, an individual identified as ThinkingOne released 34 gigabytes of data with 201 million X user records on a specialized breach forum. This information included usernames, emails, account creation dates and follower counts.

The SafetyDetectives team confirmed the validity of the emails by comparing a sample with active X profiles. The platform, both as Twitter and as X, has faced similar issues before, from the sale of 33 million login details in 2016 to a bug in 2023 that allowed account takeover with a single click.

Bot attacks and phishing campaigns continue to threaten users

To continue causing damage, existing data leaks do not depend on new intrusions. Email addresses that are already in circulation are used to fuel two types of persistent attacks.

In April 2026, researchers at Breakglass Intelligence discovered a vulnerable command and control panel that was actively exploiting stolen credentials in X accounts. Over a 12-minute period, the system tested 722,763 credential pairs and confirmed 18 new breaches.

The analyzed botnet processed more than 4.8 million X accounts throughout its operation. In these cases, two-factor authentication managed to stop 85.6% of unauthorized access attempts.

Another threat is a phishing campaign that is not linked to data leaks but has been targeting X users since July. Cybercriminals send emails that high-fidelity mimic the platform’s legitimate “log in to new device” alerts, using the same logo, colors, and grammar. These messages trick users into clicking a link to supposedly secure their account, directing them to fake pages designed to steal credentials or install malicious software.

Concomitantly, some X users have reported unsolicited reset activity on the Proton email service as well. The company Proton confirmed the interruption of its services and reported that it is working to resolve the issue.

Although there is no confirmation of a direct link between Proton and X by researchers or Proton itself, the situation is relevant for anyone who uses this email provider on their social network account.

Guidelines for protecting your X account

The official X documentation clarifies that the platform can proactively reset passwords for accounts considered compromised or under phishing attack, sending instructions via email. The arrival of an unsolicited reset email, therefore, indicates an attempt to use your credentials or that you have been targeted by a phishing campaign.

Before clicking on any link, always check the sender’s address. X informs that it only sends emails from @X.com or @e.X.com and never requests passwords via email. It is also advisable to change two-factor authentication to an authenticator application, use a unique password for X and constantly check active sessions and applications connected to your account for suspicious activity.

A crucial additional security measure is to activate the “protect password reset” option, which can be found in the “security and account access” settings of X. This function requires a verification of the associated email before processing any password reset requests, strengthening account protection.

It is also critical to avoid contact with anyone offering outside help in resolving these security issues. These are generally known scams that emerge when users mention specific terms or seek support on security topics.

For those using Proton as their X-linked email, the provider’s status page recorded a service outage on September 1st. The issue was attributed to hardware failures remaining from an overheating the previous week and reduced capacity while the engineering team worked to restore infrastructure. Although there is no connection to X activity, the outage may have delayed receiving reset emails.

At the time of deactivation of the botnet control panel in April, the tool had confirmed 138 account compromises in 4.8 million attempts. Although it represents a small percentage, this number is part of a larger context of 26 billion “credential-stuffing” attempts that, according to industry estimates, occur monthly on login pages globally.