X Users Hit by Wave of Unrequested Password Resets Amid Credential-Stuffing Surge
On September 1, 2026, X (formerly Twitter) users reported a surge of unsolicited password reset emails, login alerts from unfamiliar locations, and temporary account lockouts all originating from X’s legitimate systems. While the company has not confirmed a new breach, the incident mirrors past security scares, including a January 2026 Instagram reset email wave linked to a dark-web dataset of 17.5 million accounts.
X engineer Mridul Singhai acknowledged the issue in a tweet, stating the company is investigating but has found no evidence of a breach. Attackers appear to be targeting accounts in hopes of accessing X’s financial features, such as @XMoney. The activity may stem from older exposures, including a 2022 API vulnerability that leaked 200 million user records and a 2025 BreachForums dump containing 201 million X profiles.
Security researchers at Breakglass Intelligence uncovered an unsecured botnet in April 2026 testing stolen credentials against X accounts, with 4.8 million attempts logged and 138 confirmed compromises. Meanwhile, a separate phishing campaign has been impersonating X’s login alerts since July, tricking users into revealing passwords or authorizing malicious apps.
Proton email users also reported disruptions, though no direct link to the X activity has been confirmed. X’s help documentation notes that unrequested reset emails may indicate attempted credential-stuffing or phishing. The company advises users to verify sender addresses, enable authenticator-based two-factor authentication, and review active sessions for suspicious activity.
The incident underscores the ongoing risk of credential-stuffing attacks, which industry estimates suggest exceed 26 billion attempts monthly. While X has not reported a breach, the combination of leaked datasets, botnet activity, and phishing campaigns continues to pose a threat to user accounts.
Source: https://tech.yahoo.com/cybersecurity/articles/x-data-breach-users-getting-162610650.html
Instagram TPRM report: https://www.rankiteo.com/company/instagram
"id": "ins1788283951",
"linkid": "instagram",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'customers_affected': 'Millions of Users',
'industry': 'Technology',
'name': 'X (formerly Twitter)',
'size': 'Large',
'type': 'Social Media Platform'}],
'attack_vector': ['Phishing', 'Botnet', 'Stolen Credentials'],
'customer_advisories': 'Verify sender addresses, enable authenticator-based '
'2FA, and review active sessions for suspicious '
'activity.',
'data_breach': {'number_of_records_exposed': ['200 Million (2022)',
'201 Million (2025)',
'17.5 Million (2026)'],
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (Personally Identifiable '
'Information, Financial Features '
'Access)',
'type_of_data_compromised': ['User Credentials',
'Account Information']},
'date_detected': '2026-09-01',
'date_publicly_disclosed': '2026-09-01',
'description': 'On September 1, 2026, X (formerly Twitter) users reported a '
'surge of unsolicited password reset emails, login alerts from '
'unfamiliar locations, and temporary account lockouts all '
'originating from X’s legitimate systems. While the company '
'has not confirmed a new breach, the incident mirrors past '
'security scares, including a January 2026 Instagram reset '
'email wave linked to a dark-web dataset of 17.5 million '
'accounts. Attackers appear to be targeting accounts in hopes '
'of accessing X’s financial features, such as @XMoney. The '
'activity may stem from older exposures, including a 2022 API '
'vulnerability that leaked 200 million user records and a 2025 '
'BreachForums dump containing 201 million X profiles.',
'impact': {'brand_reputation_impact': 'Potential Reputation Damage',
'identity_theft_risk': 'High',
'operational_impact': 'Temporary Account Lockouts',
'payment_information_risk': 'High (for accounts with financial '
'features)',
'systems_affected': ['X User Accounts']},
'initial_access_broker': {'high_value_targets': ['Accounts with Financial '
'Features (e.g., @XMoney)']},
'investigation_status': 'Ongoing',
'lessons_learned': 'Ongoing risk of credential-stuffing attacks due to leaked '
'datasets and phishing campaigns. Importance of '
'multi-factor authentication and user vigilance.',
'motivation': ['Financial Gain', 'Unauthorized Access to Financial Features'],
'post_incident_analysis': {'corrective_actions': ['Enhanced User Education',
'Stronger Authentication '
'Measures'],
'root_causes': ['Leaked Datasets (2022, 2025, '
'2026)',
'Botnet Activity (April 2026)',
'Phishing Campaigns (July 2026)']},
'recommendations': ['Enable Authenticator-Based 2FA',
'Review Active Sessions for Suspicious Activity',
'Verify Sender Addresses for Emails',
'Monitor for Phishing Attempts'],
'references': [{'source': 'Breakglass Intelligence'},
{'source': 'X Engineer Mridul Singhai (Tweet)'},
{'source': 'X Help Documentation'}],
'response': {'communication_strategy': ['Tweets from X Engineer',
'Help Documentation Updates'],
'containment_measures': ['User Advisories', 'Session Reviews'],
'incident_response_plan_activated': 'Investigation Ongoing',
'remediation_measures': ['Enable Authenticator-Based 2FA',
'Review Active Sessions']},
'stakeholder_advisories': 'Users advised to enable 2FA and review active '
'sessions.',
'title': 'X Users Hit by Wave of Unrequested Password Resets Amid '
'Credential-Stuffing Surge',
'type': 'Credential-Stuffing Attack',
'vulnerability_exploited': ['2022 API Vulnerability', 'Dark-Web Datasets']}