An mSecure password reset warning went to current and former customers on November 3, 2026, after developer mSeven Software said it had “recently learned of suspicious activity” linked to mSecure, Cyber Security News reported. The Hacker News says customers are being urged to act now, possibly by changing passwords, resetting two-factor authentication, and removing passkeys, and that the email offers those steps as possibilities. It does not say whether vaults were opened, how many people are affected, or which systems were involved.
Key Takeaways
- mSeven emailed current and former mSecure users on November 3 about suspicious activity.
- Customers are urged to act, possibly by changing passwords, 2FA, and passkeys.
- mSeven has not said whether vaults, keys, or readable data were accessed.
- As of 18:00 UTC November 3, no matching posts appeared on X or Facebook.
What the mSecure Password Reset Email Requires
mSeven said it had started an investigation, taken steps to limit the problem, and brought in external cybersecurity experts. CyberInsider reports that the notice calls for immediate action to protect confidential information in the app. The Hacker News notes the steps are offered as possibilities and does not say which accounts to deal with first or how to carry out each step.
The email also does not say whether customers should keep using mSecure, including to store new passwords. It does not say whether the two-factor and passkey advice covers vault items, the account sign-in, or both.
A customer posted the email text on mSecure’s support forum on November 3. As of 18:00 UTC on November 3, The Hacker News found no staff reply and no post about it on mSecure’s X or Facebook accounts. On Reddit, CyberInsider reported, some recipients questioned the email’s authenticity because no public announcement was visible.
| Item | Possible step in the notice | Exposure confirmed in the notice |
|---|---|---|
| Stored passwords | Change them | Not stated |
| Two-factor methods | Reset or re-enroll | Not stated |
| Passkeys | Remove existing passkeys | Not stated |
What the Notice Still Does Not Say
The notice does not name systems, say when the activity occurred or whether it has stopped, or give a recipient count. It calls for immediate action without naming accounts, app versions, or storage options, Cyber Security News reports. CyberInsider adds that it does not confirm whether attackers accessed or stole encrypted vaults, obtained encryption keys, or viewed data in readable form, and does not say if the advice is precautionary or based on exposure. Cyber Security News cautions against treating a confirmed vault theft as established fact.
Encryption Claims and the 2025 BSI Review
mSecure runs on Windows, macOS, Android, and iOS and supports storing records, documents, passkeys, and one-time codes. On the Essentials plan and above, mSecure 7 can store passkeys and two-factor codes beside passwords, The Hacker News reports. Sync paths are mSecure Cloud, Dropbox, iCloud, and Wi-Fi. Neither that report nor CyberInsider found any distinction in the email among those paths or local-only vaults.
mSecure says vault data is encrypted on the device before sync and that developers cannot access customer information, The Hacker News reports. CyberInsider reports local AES-256 encryption and a locally generated Account Key protected by the account password. Analysis: the email does not say whether activity reached vault data or the keys that protect it, so those protections cannot be verified from the notice alone.
In a December 2025 study, Germany’s Federal Office for Information Security (BSI) found that mSeven could in theory access stored data in mSecure 6.1.5 for Android. The BSI tested only that version, and results may have changed with later updates, The Hacker News notes. Cyber Security News says that finding does not prove how the current incident happened. As of 18:00 UTC on November 3, the newest iPhone version of mSecure in Apple’s App Store was 7.1.0, released on October 23.
What IT Teams Should Change First
Existing mSecure guidance on unauthorized sign-in, cited by Cyber Security News, says changing the manager password alone does not secure credentials already copied elsewhere. Make changes on each service’s official website or app, and put sensitive accounts first.
- Change primary email, financial, and other sensitive account passwords on the service’s own site or app.
- Treat password, two-factor, and passkey steps as possibilities; the email does not say if 2FA and passkeys mean vault copies, sign-in, or both.
- Treat every sync path as unranked: the notice does not separate mSecure Cloud, Dropbox, iCloud, Wi-Fi, or local-only use.
Analysis: one password manager holds many logins, so an unexplained warning forces a wide reset even when vault theft is unconfirmed. CyberInsider reported Reddit users describing the prospect of changing hundreds of credentials as a major undertaking; some had begun securing important accounts, contacted support for clarification, or planned to move to another password manager. Until mSeven says what was exposed and whether activity has stopped, do not file this as a confirmed vault compromise.
