Head of Product Marketing

X data breach? Users are getting flooded with password reset emails nobody requested. X engineers have acknowledged the issue, but have not confirmed a new data breach of its systems. Sep 1, 2026 In brief. * X users have been posting since early August about password reset emails, login alerts, and account lockouts they never triggered. * X has not admitted or reported a new data breach; researchers trace the activity to a 2021-2022 API flaw, a 2025 dataset of 201 million records, an active botnet, and a phishing campaign running since July. * Proton, which some X users rely on as a recovery email, is separately dealing with a service disruption tied to a hardware failure, unrelated but relevant if that's the inbox tied to your account. X users have spent the past several weeks getting password reset emails they never asked for, including a massive rush of them just today. Some X users are also seeing login alerts from unfamiliar locations, and a handful report getting temporarily locked out of accounts they hadn't touched in weeks. The reset emails are real, not spoofed - they come from X's own systems. So, the emails are legitimate, but they were unrequested from the legitimate owner of the account, which is what has everyone freaking out right now. It's a familiar setup. Instagram users lived through nearly the same scare in January, when unrequested reset emails coincided with a dataset tied to 17.5 million accounts appearing on a dark-web forum hours earlier, Forbes reported at the time. Meta later confirmed a bug let outside parties trigger the reset emails, while denying any breach of its own systems. An old flaw that keeps feeding new scares. X hasn't admitted or reported any recent breach, but the company is aware of the situation. In a recent tweet, X engineer Mridul Singhai apologized for the inconvenience and said they are not aware of any new breach, and hackers seem to be looking to control X accounts in an effort to gain access to X money. It's possible that the recent rush of emails is related to a years-old exposure that may be resurfacing. A vulnerability in Twitter's API allowed an attacker to match email addresses and phone numbers to accounts in January 2022, and the resulting dataset covering more than 200 million users is now cataloged as its own entry on Have I Been Pwned. Site founder Troy Hunt found that 98% of the addresses in that dataset had already surfaced in earlier, unrelated breaches. A newer file compounds the problem. In April 2025, a hacker using the handle ThinkingOne posted a 34-gigabyte file containing 201 million X user records - screen names, email addresses, account-creation dates, follower counts - on the forum BreachForums, according to Fox News. Researchers at SafetyDetectives checked a sample against live X profiles and confirmed the emails matched active accounts. Twitter and X have handled versions of this before, from a 2016 sale of 33 million logins to a run of incidents Decrypt has chronicled over the years, including a 2023 bug that let anyone take over an account with one click before a researcher who found it got banned instead of paid. Bots doing the legwork, and phishing doing the rest. Neither dataset needs a fresh hack to keep causing damage. Circulating email addresses feed two ongoing operations. Researchers at Breakglass Intelligence found an unsecured command-and-control panel in April 2026 that was actively running stolen credentials against X accounts, testing 722,763 pairs in a single 12-minute observation window and confirming 18 new compromises. Over its lifetime the botnet had run more than 4.8 million X accounts through the checker, with two-factor authentication blocking 85.6% of the attempts. Separately, a phishing campaign that has nothing to do with any dataset has been targeting X users since July. Scammers are sending emails that nearly replicate X's real "new device login" alerts - same logo, same colors, correct grammar - asking recipients to click a link to secure their account, The Guardian reported. The links lead to fake pages built to steal a password or authorize a malicious app, and the campaign doesn't require any breach at all to work. Some X users say they're also seeing unrequested reset activity on the Proton email service around the same time. Proton confirmed the disruption and is working on the issue. Neither Proton nor any security researcher has confirmed a link, but it's important in case that is the email you use for your X account. What to do about it. X's own help documentation confirms it proactively resets passwords for accounts flagged as compromised or targeted by phishing, sending an email to the account's registered address with instructions. If one of those lands without you asking, someone has likely already tried your credentials, or you've been targeted by one of the phishing emails. Check the sender address before clicking anything. X says it only emails from @X.com or @e.X.com and never asks for a password by email. Beyond that, switch two-factor authentication to an authenticator app, use a password unique to X, and check your account's active sessions and connected apps for anything unfamiliar. One important thing to do is to check the "password reset protect" box on the "security and account access" option in the X configuration. This adds another layer of security, prompting a verification of the associated email address before a password reset request is sent out. Also, do not contact anyone offering help. These are well known scams that appear when people mention specific keywords or ask for help on specific security topics. The link below is an example. One more thing worth knowing if Proton is the inbox tied to your X account: Proton's status page reported a service disruption on September 1, attributing it to residual hardware failures from an overheating incident the week before and reduced capacity while engineers bring additional infrastructure online. It isn't connected to the X activity, but it could delay a reset email reaching you if you need one. By the time researchers took the April botnet's control panel offline, it had confirmed 138 account compromises out of 4.8 million attempts - a fraction of a percent, but one multiplied across roughly 26 billion credential-stuffing attempts industry researchers estimate hit login pages worldwide each month. Start every day with the top news stories right now, plus original features, a podcast, videos and more.

ProtonMail down? Outage reports surge again days after cooling failure knocked out Frankfurt Data Center now. Privacy-focused email service ProtonMail experiences multiple outages, including a major data center cooling failure. Published 09/02/26 AT 12:15 AM AEST Users of privacy-focused email service ProtonMail began reporting access problems again Tuesday, according to outage-tracking service Downdetector, marking the latest in a string of disruptions that has hit the Swiss company over the past week, including a major outage caused by a data center cooling failure in Germany. Downdetector posted on X shortly after Tuesday's reports began surfacing. "User reports indicate problems with ProtonMail since 9:24 AM EDT," the account wrote, asking affected users to describe how the disruption was impacting them under the hashtag #ProtonmailDown. Separate outage-tracking service StatusGator recorded a similar incident later Tuesday, logging a five-minute disruption beginning around 12:24 p.m. Eastern time tied to an internal server error that prevented users from accessing the service, an issue the company officially acknowledged roughly 16 minutes after it began. Proton's own status page separately confirmed at 12:37 p.m. Eastern time that a small number of users were experiencing access issues, writing that its team was investigating and would share updates as they became available. Tuesday's reports add to what has become an unusually turbulent stretch for the encrypted email provider. According to StatusGator's incident tracking, ProtonMail experienced a separate two-hour, 44-minute outage Sunday evening that left users unable to access mail or calendar features, an issue that, like Tuesday's disruption, was never officially acknowledged by the company through its public status channels. The most significant recent incident occurred Aug. 27, when Proton confirmed a critical cooling failure at one of its data centers in Frankfurt, Germany, took the service offline, according to reporting from Data Center Dynamics. Proton's team wrote in an update at the time that the outage had been largely resolved, though some users continued experiencing delays in email delivery, reception and notifications as engineers worked to clear remaining issues. The company said no user data was lost as a result of the incident, and Proton CEO Andy Yen later acknowledged the severity of the company's response, saying "we fucked up" regarding the slow failover process that extended the outage's impact, according to Data Center Dynamics' reporting. The Frankfurt outage was notable in part because of Proton's broader infrastructure history. The company, which markets itself heavily on end-to-end encryption and user privacy, previously hosted its infrastructure inside a former K7 military bunker located under roughly 1,000 meters of granite in Attinghausen, Switzerland, and has also operated data center infrastructure from a site in Lausanne, Switzerland, reflecting the company's emphasis on physically secure hosting locations even as it has expanded its infrastructure footprint into other European data centers, including the affected Frankfurt facility. Despite the recent pattern of disruptions, not every monitoring service showed evidence of a major ongoing problem as of Tuesday. Outage tracker Entireweb reported that ProtonMail was "operating normally" as of Tuesday, noting only four total user reports over the preceding 24-hour period, with just one submitted within the final hour before its status check, a discrepancy that illustrates how quickly outage-reporting metrics can shift and how different monitoring platforms can produce varying pictures of the same service's health depending on their underlying data sources and update frequency. ProtonMail, founded in 2014 and based in Switzerland, has built its reputation around strong privacy protections, including a policy of not tracking, logging or sharing users' personal information, positioning itself as an alternative for individuals and organizations concerned about surveillance, hacking or general data security. The company's broader Proton ecosystem includes additional privacy-focused products such as Proton VPN, Proton Drive and Proton Calendar, several of which have also experienced intermittent service issues in recent weeks alongside the email platform. As of this report, Proton had not issued a comprehensive public statement addressing the full scope, cause or resolution timeline for Tuesday's reported ProtonMail disruption specifically. Affected users have been encouraged to monitor Proton's official status page directly at status.proton.me for the most accurate and up-to-date information regarding the service's operational status.