mSeven Software urges mSecure customers to change passwords and reset passkeys

On November 3, mSeven Software sent an email to current and former mSecure customers warning of suspicious activity tied to the password manager app. The company said it had “recently learned of suspicious activity,” but it has not described what took place or confirmed whether customer data was exposed.sources

The company has not confirmed that attackers entered encrypted vaults, obtained encryption keys, or viewed customer information in readable form. It framed the recommended steps as a precaution, not a reaction to a confirmed breach, and it has not said whether the activity has stopped. Possession of encrypted data does not prove that the contents were decrypted.sources

The company has not named the affected systems, given a timeframe, said whether the activity has stopped, or counted how many customers received the email. mSecure says vault data is encrypted on the user’s device before syncing, and that its developers cannot view customer-stored items. There is not enough technical detail in the notice to show whether those protections were affected, and the notice does not separate the risk for local-only vaults from the risk for data synchronized through third-party services, leaving relative exposure unclear.sources

The advice says customers may need to remove existing passkeys, reset or re-enroll two-factor authentication, and change passwords. The notice offers no priority order for those resets and no instructions for how to carry them out, and it does not say whether customers should keep using mSecure, including for new passwords. According to existing mSecure guidance, changing the manager password alone does not secure credentials that were copied previously.sources

Customers should begin with e-mail, banking, and other sensitive accounts, changing passwords through each service’s official site or app. Security practitioners generally treat an unexplained warning as a reason to change their most sensitive credentials first, and they recommend starting with e-mail, banking, and accounts that can reset others. A NordPass survey published in May found roughly 120 personal passwords per individual and 67 work-related ones.

On the Essentials plan and above, mSecure 7 supports passkeys and two-factor authentication codes alongside passwords. The app runs on Windows, macOS, Android, and iOS and holds passwords, sensitive records, documents, passkeys, and one-time authentication codes.sources

The Account Key is created locally and locked by the user’s account password, according to company documentation. Before the vault leaves the device, data is encrypted locally using AES-256. It is unclear whether the notice’s advice covers stored items, the account sign-in, or both.sources

Vaults can sync through mSecure Cloud, Dropbox, iCloud, or a local Wi-Fi connection. The notice does not say whether the choice of sync route matters, and the company has not said whether the activity reached vault data or the keys that protect it.

mSeven said it began an investigation, took containment measures, and brought in outside cybersecurity experts. By 18:00 UTC on November 3, mSecure’s X and Facebook accounts carried no message about the email, and no staff member had replied in the support-forum thread by that time. By 20:00 UTC on November 3, more than a dozen customers had replied in the support-forum thread without receiving a company answer.sources

Forum users asked whether the incident affected stored logins, encryption keys, or master passwords and whether storing replacement credentials in mSecure would be safe. Recipients discussed the warning on Reddit and mSecure’s support forum, and multiple recipients described redoing hundreds of credentials as a major task. Some recipients secured important accounts, contacted support, or planned to move to another password manager.

Some recipients questioned the e-mail’s authenticity because they could find no matching public announcement. As of 18:00 UTC on November 3, the newest mSecure iPhone app in Apple’s App Store was version 7.1.0, released October 23.

In 2022, LastPass disclosed its breach in stages over roughly six months. It first reported unusual activity in its development environment and stolen source code on August 25. It later reported access to customer account data on November 30, and the company said backups of encrypted vaults were copied on December 22. A completed investigation and recommended actions arrived on March 1, 2023, and those backups mixed encrypted fields with unencrypted data such as website URLs.

A rule in force in Japan since April 2022 requires notification for incidents involving sensitive data, financial-loss risk, malicious intent, or more than 1,000 affected people. Taiwan’s notification duty applies when a breach results from violating its Personal Data Protection Act.

Customers continue to wait for mSeven to identify exposed data, failed safeguards, and whether remediation is finished. Vendors in the password-management sector typically rebuild confidence with a public post-incident report.sources

In December 2025, Germany’s Federal Office for Information Security published a study finding that mSecure 6.1.5 for Android stored data might theoretically be accessed by mSeven. BSI tested only that version, so later updates could have altered the outcome. The incident follows a separate December 2025 BSI review, but that earlier finding does not establish the cause of the current incident.sources