I spent my afternoon chasing the unsolicited X password-reset emails instead of assuming the site got dumped. A lot of people got real reset mail from X, not random spoof domains. Some got several in a few minutes. I did too. That part is real. X’s public line, from product engineer Mridul Singhai: attackers appear to want accounts now that X Money is widely available, they are investigating, and so far there is no evidence of an X systems breach. He also apologized for the multiple emails. The mechanism is dumber than a Hollywood hack 😂 . If Password Reset Protect is off, X will take a reset request with only your public username and then email the address already on the account. So: - a reset email does not mean they have your inbox - it does not mean X just leaked its database today - a public handle list is enough That is why it spiked today. X Money rolled out to US Premium / Premium+ over the summer. Wallet, P2P, Visa card. By now those accounts look like wallets. That matches what X itself said. Multiple emails fit the same handle getting submitted over and over. One script, or a few bots sharing one list. Volume is the spray, not proof of a new core breach. I also checked the theory that @commonsmade got popped because people connected X for the airdrops,at the moment that is untrue . A handle-only OAuth list could feed this without leaking inboxes. People who never touched that app are getting the same official X mails. If both groups are hit, commonsmade is at most one list among older public dumps. Treat it as a lead, not a conclusion. What I could not get from public data: the operator, the box hitting the form, a confirmed commonsmade breach, or a confirmed new X infra breach. X can see the source IPs. I cannot. What I did: Password Reset Protect on, app 2FA, revoked sessions I did not recognize. I am not clicking anything in those emails. If a second mail shows up looking like X support, that is the phishing pass. If you got hit, tell me three things: Reset Protect on or off, X Money on or off, and whether you connected X to an airdrop or any other app. I want the pattern, maybe we can get somewhere ```