X (Twitter) account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through X (Twitter)’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
Password reset emails from X you never asked for (September 2026)
Since early August 2026, and in a heavy burst around 1 September, X users have been receiving password reset emails, login alerts from places they have never been and short account lockouts — all sent by X's own systems, none of them requested. X says it has found no evidence of a new breach: engineer Mridul Singhai posted that attackers appear to believe they can get into accounts now that X Money is widely available, and apologised for the volume of email. Researchers looking at the wave describe public usernames being fed into the account-recovery form in bulk, rather than anything new being stolen. The practical read is worth holding on to: an unrequested reset email means somebody typed your handle into a form, and the email does nothing at all until a link inside it is used. So do not use it. Open the app or type the address yourself, check active sessions and connected apps under security settings, make sure app-based two-factor is on, and turn on the password-reset protection setting, which stops a reset from starting unless whoever asked can already produce the email or phone number on the account.
X engineer Mridul Singhai's public statement of 1 September 2026, plus reporting by Decrypt, The Daily Hodl and Sumsub, 1–2 September 2026. No breach has been confirmed by X or by any regulator.
If your X (Twitter) account was hacked: start recovery at the official page (help.x.com/en/safety-and-security/x-account-compromised), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your X (Twitter) account, step by step
These steps follow X (Twitter)’s official process. Official links only: account recovery · password reset · two-factor setup.
If you can still log in: change the password immediately and revoke unknown sessions AND connected apps (Settings → Security and account access).
Locked out: submit the compromised-account form on the official help page with your @handle and any email/phone ever attached.
Watch the inbox you filed with — X replies there with verification questions; answer from that same address.
After access is restored, re-check email, phone, connected apps and active sessions, then enable app-based two-factor authentication.
What trips people up with X (Twitter)
- X support is heavily automated — the compromised-account form works, but replies can take days; keep the case number and reply from the email you filed with, or the thread resets.
- Check Settings → Security → Apps and sessions after recovery: takeovers frequently happen through an old third-party app authorization, and it survives a password change unless you revoke it.
Was X hacked? What the reset-email wave actually is
No confirmed breach, and the wording matters because the press has been careful about it too — the coverage says "fears" and "claims", not "confirmed". What is real is the volume: people reporting up to ten unrequested reset emails in a few hours on 1 September 2026, along with unfamiliar login alerts and temporary lockouts. All of it came from X's legitimate systems, which is precisely why it frightened people. The company's position, stated publicly by one of its engineers rather than through a press release, is that it found no evidence of a new breach and that attackers appear to be probing accounts now that the payments feature is widely available.
The mechanism researchers describe is mundane and worth understanding, because it defuses most of the panic. X's account-recovery form takes a public username and emails whoever owns it. Feed it a long list of handles and you generate exactly this: a flood of genuine reset emails to people who did not ask for one. The handle lists are not new either — reporting points back to a 2021–2022 API flaw that exposed records for over 200 million accounts and a dataset of around 201 million X profiles published in April 2025. Separately, Breakglass Intelligence described finding an unsecured control panel for a botnet testing stolen credentials against X, saying it had run more than 4.8 million accounts through the checker and that two-factor authentication blocked 85.6 per cent of the attempts. Running alongside all of it, since July, is a phishing campaign imitating "new device login" notices.
So the honest answer to "was I hacked" is almost always no, and the honest answer to "should I do anything" is yes, two small things. The reset email is inert unless its link is used, so ignoring it is safe and clicking it is the only real risk in your inbox this week. Turn on app-based two-factor authentication, since by the botnet operators' own dashboard that is what stops the attempts, and switch on password-reset protection so the recovery form stops answering to your handle alone. If you did click a link and enter a password, treat it as a compromise and work through the recovery steps below.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in X (Twitter)'s security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Locked out of X (Twitter) — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to X (Twitter)'s dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice X (Twitter) sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Got a "new login" alert from X (Twitter)?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for X (Twitter)). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Lost your 2FA device or codes
If you changed phones or lost access to your authenticator, use the backup codes you saved when enabling 2FA — that's exactly what they're for. No backup codes? X (Twitter)'s account-recovery flow (link above) can verify you through other signals — original signup details, linked email, purchase history or ID verification — but it's deliberately slow, since the same door would otherwise let attackers in. Start the process immediately and respond fast to any follow-up; recovery requests that go quiet get closed.
The hacker is messaging your contacts
Attackers monetize a stolen X (Twitter) account by hitting your contacts — typically 7 in 10 victims see the hacker impersonate them with "help me out" payment requests, crypto pitches or malicious links. Warn people through another channel (text, email, another platform) as soon as you know you're compromised, and tell them not to click anything "you" sent. It protects your friends and creates a paper trail that helps your recovery and any ban appeal.
X (Twitter) banned or disabled the account after the hack
Very common: the attacker used your account for spam, scams or rule-breaking, and X (Twitter)'s automated systems suspended it before you got it back. Don't create a replacement account — that can itself violate the terms and complicate reinstatement. Instead, appeal through the official process and state clearly that the account was compromised, when you lost access, and that the violating activity wasn't yours. Appeals that mention a documented hack (password-change emails, login alerts — keep the timestamps) are routinely overturned, but it can take days to weeks.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on X (Twitter) (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). X (Twitter) itself has appeared in known breach data — see the Twitter exposure for what leaked and when.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor (official X (Twitter) setup) stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked X (Twitter) account, answered
How did my X (Twitter) account get hacked?
The most common cause isn't a hack of X (Twitter) itself — it's credential stuffing: a password you used on X (Twitter) leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake X (Twitter) login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my X (Twitter) account back?
Usually yes. Use the official recovery flow (https://help.x.com/en/safety-and-security/x-account-compromised) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new X (Twitter) account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so X (Twitter) can lock it, before you start over.
The hacker is posting and messaging as me on X (Twitter) — what do I tell people?
Warn your contacts through another channel not to click links or send money to "you", and report the account as compromised to X (Twitter) even before recovery finishes. Most platforms freeze visibly abusive accounts fast, which cuts the damage while your recovery case is processed.
Why am I getting password reset emails from X that I never requested?
Because somebody submitted your username to X's account-recovery form, most likely as one entry in a very long automated list. The form is public by design — that is how anyone who has genuinely forgotten a password gets back in — so it will email the owner of any handle it is given. Getting one, or ten, means your handle is on somebody's list. It does not mean anyone has your password or is inside the account, and the email itself changes nothing until the link inside it is used.
Does this mean my X account was hacked?
Almost certainly not, and there are two specific things to check rather than guess. Open security settings and look at the list of active sessions and logged-in devices; then look at connected apps. If nothing there is unfamiliar and you can still sign in normally, the reset emails are noise aimed at your handle. If a session or a device you do not recognise is listed, that is a different situation and the recovery steps on this page are the ones to follow.
Should I change my X password because of this?
Only if that password is reused somewhere else, or if you clicked a link in one of the emails — and in the second case change it immediately, from the app rather than from any message. Otherwise a password change is not what closes this off. Two-factor authentication is: the people watching the credential-testing botnet reported it blocked the overwhelming majority of attempts against accounts that had it enabled. Use an authenticator app rather than SMS if you can, since text codes can be intercepted through your phone carrier.
What is password reset protect, and should I turn it on?
It is a setting in X's security options that stops the password reset flow from working on a username alone — whoever starts a reset has to confirm the email address or phone number already on the account first. Turning it on is the single most direct answer to this particular wave, because it takes your handle out of the list of things that will generate a reset email. It is worth the thirty seconds even after the news cycle passes.
Was there an X data breach in September 2026?
None has been confirmed. X says it found no evidence of one, and the reporting has been careful to frame the story as concern rather than fact. What does exist is older: an API flaw disclosed in 2021–2022 that exposed records for more than 200 million accounts, and a dataset of roughly 201 million X profiles posted to a criminal forum in April 2025. Those are where the handle and email lists behind this wave most plausibly come from, which is a very different thing from something new having been taken this month.
How do I stop my X (Twitter) account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication (official setup: https://help.x.com/en/managing-your-account/two-factor-authentication), and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.