mSecure tells users to change passwords and reset 2FA after 'suspicious activity'

The skim

• mSeven Software, maker of the mSecure password manager, emailed current and former customers on Nov. 3 about "suspicious activity" and told them to protect everything stored in the app.
• The email suggests changing passwords, resetting or re-enrolling two-factor authentication and removing existing passkeys, but doesn't say what was accessed or whether vault data was exposed.
• If you use mSecure, treat it as serious: start with your email, Apple or Google account, banking and payment logins, and re-do any 2FA codes stored in mSecure.

What happened

"mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote in an email seen by The Register. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist."

The email continues: "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."

That is all the company has said. According to The Hacker News, the email doesn't name the systems involved, say when the activity happened or whether it has stopped, or say how many people received it. As of 18:00 UTC on Nov. 3, mSeven hadn't posted about it on mSecure's X or Facebook accounts. Customers have been asking for details in a thread on mSecure's support forum.

Why it matters

A password manager holds the keys to everything else, so even a vague warning carries weight. mSecure says vault data is encrypted on your device with AES-256 before it syncs and that it can't read customers' data, CyberInsider notes. But the notice doesn't confirm whether encrypted vaults or encryption keys were taken, or whether its advice is precautionary. The Hacker News also points to a December 2025 study by Germany's BSI that found mSeven could, in theory, access stored data in mSecure 6.1.5 for Android; the BSI tested only that version.

mSecure 7 can store passkeys and 2FA codes alongside passwords. If your one-time codes live in the same vault as your passwords, one exposure could undo both layers of protection, which is why the 2FA advice matters.

What to do now

1. Change your mSecure account password first.
2. Change your most important passwords next: email, Apple Account or Google Account, banking, PayPal and other payment services. Your email matters most, because it can reset everything else.
3. Re-do 2FA anywhere mSecure stores the codes. Turn two-factor off and on again for those accounts to get a fresh setup key, ideally in a separate authenticator app.
4. Remove and recreate passkeys stored in mSecure, as mSeven suggests.
5. Work through the rest of your vault, oldest and most sensitive logins first.
6. Beware of follow-up phishing. Scammers often send fake "breach" emails after news like this. Act only through the app or sites you type in yourself.

New to passkeys? Here's how to set them up on iPhone, Android and Windows.

Sources: The Register, The Hacker News, CyberInsider and mSecure support forum.