PLATFORMS Signal 39
X investigates mass password reset attempts targeting users following X Money launch
↗
X is investigating a wave of unsolicited password reset emails that users began receiving after the rollout of its payments service, X Money, with no confirmed breaches so far.
Only one feed is carrying this story, so corroboration is thin. The appearance of a payments product immediately attracted account-takeover attempts, which is a pattern any platform adding financial features should anticipate. X has not confirmed a system breach, but the mass-triggering of reset forms using public usernames is an active operational issue.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
X product engineer Mridul Singhai said attackers appear to be targeting accounts now that X Money is widely available, but no evidence of successful breaches has been found.
Attackers are mass-triggering the password reset form using public usernames, causing widespread unsolicited reset emails.
X Money is a newly launched payments service that includes a bank card and other benefits, aimed at facilitating creator payments on the platform.
THE CLUSTER