mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity

mSeven Software emailed current and former mSecure customers on November 3, 2026, urging them to protect information stored in the password manager after suspicious activity linked to the app. The message, sent in the company's name, does not say what happened or whether stored data was exposed, but it suggests steps such as changing passwords, resetting two factor authentication and removing passkeys.

Warning Email and Public Response

The email says mSeven started an investigation, took steps to limit the problem and brought in outside cybersecurity experts. It does not name the systems involved, say when the activity happened or whether it has stopped, or give the number of people who received the email. A customer who received it posted its text in a thread on mSecure's support forum on November 3. As of 18:00 UTC on November 3, mSeven had posted nothing about the email on mSecure's X and Facebook accounts, and no staff member had replied in that forum thread.

Sync, Stored Credentials and Encryption

mSecure can sync a customer's vault through mSecure Cloud, Dropbox, iCloud or Wi-Fi. The email does not say whether it matters which of these a customer uses. mSecure 7 can keep passkeys and 2FA codes in the vault next to passwords, on its Essentials plan and above. The email's advice is about protecting information stored in mSecure, but it does not say whether the 2FA and passkey steps cover those stored items, the mSecure account's own sign in, or both.

mSecure says vault data is encrypted on the customer's device before it is synced, and that even its developers cannot access customers' information. In mSecure 6.1.5 for Android, mSeven could, in theory, access stored data, according to Germany's Federal Office for Information Security, which found this in a study published in December 2025. The office tested only that version, and its results may have changed with later updates. The email does not say whether the suspicious activity reached vault data or the keys that protect it.

What Customers Are Asked to Do

The email offers its steps as possibilities and does not say which accounts to deal with first or how to carry out each step. It also does not say whether customers should keep using mSecure, including to store their new passwords. As of 18:00 UTC on November 3, the newest iPhone version of mSecure in Apple's App Store was 7.1.0, released on October 23.

Sources: The Hacker News