Account recovery exists to admit people who cannot authenticate. That is the function it is built for: forgot-password features, account-recovery forms, and the other mechanisms meant to get a legitimate user who has lost access back in [6]. Attackers go at weaknesses in those processes to obtain access to accounts [7].
Run the numbers on the scale figure. Read "hundreds of thousands" at its floor, 200,000, and take the window as the week Blanche described [1]. That works out to roughly 28,600 accounts a day, sustained for seven days [12]. If the run was two days rather than seven, it is 100,000 a day [12]. Nobody hand-works a recovery form at that rate. Someone was scripting requests against an endpoint and cycling identifiers.
Everything on the record comes from one place: a statement by the Attorney General, posted on the platform involved [1]. The statement does not name an actor, does not give a location, and does not describe a technique [4]. The publisher sets the incident against a broader rise in AI-driven attacks and ransomware [10], and Blanche linked the X attempt to neither [4]. Automation at volume is automation at volume until someone shows the tooling.
Without the technique, the checkable thing on your own stack is rate. How many recovery initiations per identifier, per source address, per hour does your flow accept before anything objects, and does anyone read that counter. That question survives whatever X turns out to have patched or throttled.
The department announced an operation days earlier against QTFY, which US authorities describe as a Chinese cyberespionage platform that had targeted US institutions including the Senate, the Federal Reserve and NASA [8][9]. Different victims, different objective. Filing both under one heading is how the specific lesson here goes missing: the X attempt reached for consumer accounts in bulk through the one door designed to open without credentials [1][6].
