mSeven Software, the developer of the mSecure password manager, is warning current and former customers to change their passwords, reset two-factor authentication and remove existing passkeys after what it described as suspicious activity tied to the app. In follow-up replies to customers, the company said an unauthorized actor acquired an encrypted copy of a database containing information belonging to mSecure users.
What mSeven told customers
The first warning arrived by email on November 3, 2026, under the subject “Important security notice about your mSecure account.” Customers posted the full text on mSecure’s own support forum the same day.
“mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application,” the email reads. “In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist.”
The notice told recipients to “immediately take steps to protect all confidential information stored within the mSecure password management application,” adding that this “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.” It did not say what systems were involved, when the activity happened or what data was at risk.
An encrypted database copy was taken
After customers pushed for answers, mSecure support began sending a longer statement in response to tickets. Several customers shared the same text on the company’s support forum, and it matches what has been reported elsewhere.
“mSeven learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application,” the statement says. “Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.”
The statement also includes these points:
- The issue “only pertains to users that were synching with the mSecure Cloud.”
- Deleting the mSecure app “will have no impact on this situation.”
- mSeven says it has “taken steps to bolster security to help prevent future unauthorized activity.”
- The company says it has “no evidence that mSecure is not currently safe for use.”
mSeven still recommends that customers “change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information.”
What is still unknown
mSeven has not said how the attacker got access, when the database was taken, how many users are affected or whether law enforcement has been contacted. It also has not said exactly which fields the database held, such as email addresses, account details or anything used to verify a login.
As of the afternoon of November 4, no public notice about the incident appeared on the mSecure website homepage or in the Announcements section of its support forum. Customers on the forum have criticized the company for sharing more detail in ticket replies than in its original email.
How mSecure says vault data is protected
According to mSecure’s published security model, vault data is encrypted with AES-256 on the user’s device before it is synced. The app creates a random 46-character Account Key locally, and that key is protected by the user’s Account Password. The company says the Account Key is never stored on its servers and that even its developers cannot read customer data.
If that design held up, a stolen copy of the cloud database should be very hard to unlock without both the Account Password and the Account Key. The same document says mSecure emails users an encrypted copy of their Account Key, or a QR code, to set up new devices. Security researchers note that attackers who steal encrypted vaults often keep them for years and try offline cracking later, which is why weak master passwords are the biggest risk in cases like this.
mSecure is not the first password manager vendor to face questions about stolen customer data. BreachNews previously reported that LastPass confirmed customer support data was stolen through a third-party supply chain breach.
What mSecure users should do now
mSeven’s advice applies to anyone who synced with mSecure Cloud, including former customers. Users who only used Wi-Fi sync or kept data on a single device have been told the issue does not apply to them, but they may still want to follow the same steps as a precaution.
- Change your mSecure master password to a long, unique passphrase you have never used anywhere else.
- Change your most important stored passwords first, starting with email, banking, cloud storage and any account that can reset other accounts.
- Reset two-factor authentication for accounts whose 2FA secrets or backup codes were stored in mSecure, and generate new backup codes.
- Remove and replace passkeys that were saved in the vault.
- Watch financial accounts if card numbers, bank details or ID documents were stored in mSecure, and consider a credit freeze.
- Be alert for phishing emails that use the incident as a lure, and only sign in through the official app or website.
Readers can also follow our guide on how to check if your email, phone or password was in a data breach to see which accounts may need attention first.
BreachNews will update this story if mSeven releases more details about the scope of the incident or how the database was accessed.
