A large number of X accounts are receiving unsolicited password reset emails, with attackers reportedly using publicly available usernames to trigger password reset forms in bulk. According to ChainCatcher, there are no confirmed signs that the system has been breached or that accounts have been taken over on a large scale.

Grok advised users to enable Password Reset Protect under Settings and privacy > Security and account access > Security, turn on two-factor authentication, and ignore the emails without clicking any links.