mSecure urges password resets after suspicious activity

mSeven Software is warning current and former mSecure password-manager customers to change passwords, reset two-factor authentication and remove passkeys after discovering suspicious activity connected to its cloud service. A security notice sent on 3 November says the company began an investigation, took steps to limit the incident and hired outside cybersecurity experts. It does not say which systems were affected, how many users are involved or whether customer data was accessed. ¹²

The warning has since been reported alongside customer support responses saying an attacker stole an encrypted database from mSecure Cloud. Those responses have not been published as a formal incident report from mSeven, so the exact contents of the database and the circumstances of the theft remain unconfirmed. The reported advice appears to apply to people who synchronised their vaults through mSecure Cloud, rather than necessarily every mSecure user. ¹²

That distinction matters because mSecure is designed to hold highly sensitive information, including passwords, passkeys, financial details and authentication codes. mSecure’s security material says vault data is encrypted locally and that the company uses a zero-knowledge design, meaning it should not be able to read customers’ decrypted vault contents. Encryption reduces the immediate risk, but a stolen encrypted database can still be targeted with offline attacks if a master password is weak or reused. ¹³

The available notice does not establish that attackers decrypted any vaults. It also does not clarify whether the suspicious activity involved the cloud database, account credentials, backup systems or the keys protecting customer data. mSeven reportedly told customers it has no evidence that confidential information was accessed and that it had added security measures, but the company has not yet publicly explained how the incident happened. ¹²

Customers should therefore treat the reset advice as a precaution rather than proof that every stored credential was exposed. Start with the most important accounts, replace reused passwords with unique ones, review passkeys and two-factor methods, and reach each service through its known official website rather than links in an unexpected email. Keep the old credentials available only long enough to complete the transition, then remove them from the vault if the account has been secured elsewhere. ¹²

The incident also highlights the uncomfortable gap between a technically strong encryption model and a useful public disclosure. Users cannot judge whether their risk is limited to an encrypted backup when the company has not said what was taken, when it was taken or which synchronisation methods were involved. mSeven should publish those details as soon as its investigation can support them, including whether the advice applies to former customers and what evidence it has for its current assessment. ¹²

Our opinion

A password manager asking people to rotate credentials without explaining the trigger is an unusually difficult security notice to act on. The safest reading is not that a breach of readable vault contents has been confirmed — the available evidence does not say that — but that mSeven considers the situation serious enough for customers to reduce the value of anything that may have been exposed. Clearer information about the affected systems, dates, encryption keys and scope of the reset advice is now more important than another generic reassurance.

Until that information arrives, mSecure users should act carefully without assuming the worst. Change important passwords through official account pages, prioritise reused credentials, review passkeys and authentication methods, and watch for phishing that uses the incident as a pretext. Those steps reduce practical risk while leaving room for mSeven’s investigation to establish what actually happened.