mSecure Password Manager Breach: Encrypted Database Stolen, Users Told to Reset Passwords

mSeven Software, the US company behind the mSecure password manager, has told current and former customers to change their passwords, reset two-factor authentication and remove stored passkeys, after detecting suspicious activity involving the app. Security reports say a hacker stole an encrypted copy of the company’s customer database, although mSeven has not confirmed that detail in a public statement.

The warning went out by email on Tuesday, 3 November, to people who use or used to use mSecure, an app that stores passwords, passkeys and financial details in encrypted vaults that sync across devices. The company has not said how many people were emailed, what systems were involved, or when the suspicious activity happened.

What mSeven told its customers

The security notification was short on detail. “mSeven Software recently learned of suspicious activity associated with the mSecure password management application,” it said. “In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist.”

The message urged customers to act at once to protect everything stored in the app. “This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys,” it said. It did not say what had been accessed, whether customer data had been taken, or how the incident had happened.

The Register reported that, as of the evening of 3 November, mSeven had posted nothing about the incident on mSecure’s X or Facebook accounts. BleepingComputer reported that it had contacted mSeven with questions about the incident, but had not yet received a response.

Encrypted database reportedly stolen

While the original notification gave few details, customers have since shared responses they say came from mSeven’s support team, indicating that a hacker stole an encrypted database from mSecure Cloud containing information belonging to current and former users.

According to one shared response, mSeven discovered the theft and then notified customers. The response also stated that the company had no evidence the attacker had accessed the confidential information stored inside the encrypted database, and that it had put additional security measures in place.

The same response drew a clear line around who is affected. “Please note, this issue only pertains to users that were synching with the mSecure Cloud,” it said. People who kept mSecure on a phone or computer and synced only through Dropbox, iCloud or Wi-Fi between their own devices fall outside the incident as described.

mSecure uses AES-256 encryption and a zero-knowledge design, which encrypts vault data on a user’s own device before it is sent to the company’s servers. The company says it cannot read customers’ decrypted vault contents.

Why encryption is not the whole story

An encrypted database can still pose a serious risk. If attackers can crack weak master passwords offline, they can open the vaults they stole. That is what happened after the 2022 LastPass breach, when attackers stole backups containing encrypted password vaults and researchers later linked the breach to cryptocurrency thefts.

The advice to remove passkeys is also telling. Passkeys are meant to replace passwords with a stronger, phishing-resistant login, so telling users to remove them suggests concern about account takeover rather than a routine precaution.

What mSecure users should do now

For anyone who used mSecure Cloud sync, the practical steps are clear. Change the mSecure master password to a long, unique passphrase used nowhere else. Then change stored passwords, beginning with the accounts that unlock everything else: email first, then Apple, Google or Microsoft accounts, then banking and payment logins. Reset or re-enrol two-factor authentication anywhere mSecure stored authenticator secrets or backup codes. Remove passkeys stored in mSecure, as the company advised, and recreate them where needed.

Users should also watch for phishing. Criminals often exploit breach news with fake reset emails, so any message claiming to be from mSeven should be checked carefully and never followed through links in the email itself.

What is still unknown

Much about the incident remains unclear. mSeven has published no public incident page, no user count and no technical account of how the database was taken. None of the details about the stolen database has been confirmed in an official public statement, so that part of the story rests on support replies shared by customers rather than on a formal disclosure.

That silence has frustrated customers, some of whom store hundreds of passwords in the app and now face hours of resets. Until mSeven says more, the safest course for affected users is to assume the worst and act on the company’s advice now.

The incident is the latest in a run of technology stories this week, from Oracle scrapping a $7 billion chip deal to Fal raising $1.3 billion, and it follows other recent cybercrime cases, including the Binance hack, in which the FBI listed hundreds of wallets linked to stolen funds.