Customers of the mSecure password manager are being urged to protect the information stored in it. On November 3, developer mSeven Software emailed current and former customers saying it “recently learned of suspicious activity associated with the mSecure password management application.” The company says it started an investigation, took steps to limit the problem and brought in outside cybersecurity experts. It recommends that customers “immediately take steps” that “may include changing passwords, re-setting or re-enrolling two-factor authentication methods, or removing existing passkeys.”
The email does not say what happened, which systems were involved, when the activity took place, whether it has stopped, or how many people were emailed. It also does not say whether vault data or the keys protecting it were reached. The Hacker News reports that, as of 18:00 UTC on November 3, mSeven had posted nothing about the email on its X and Facebook accounts and no staff member had replied in a customer’s support-forum thread that reproduces the email text. mSecure says vault data is encrypted on the customer’s device before it syncs and that even its developers cannot access it. Separately, Germany’s Federal Office for Information Security (BSI) found in a December 2025 study that in mSecure 6.1.5 for Android the developer could, in theory, access stored data; the BSI tested only that version, and later updates may have changed the result.
How to check if you’re affected
Affected products are mSecure installations and accounts: the email went to current and former customers, so check whether you received it. It can be hard to tell the notice from a phishing message, so compare the text with the copy posted in mSecure’s support forum (linked below) and open the app or support site directly instead of following links in a message about this.
The email lists three steps as possibilities: change passwords, reset or re-enroll two-factor authentication, and remove passkeys. It does not say which accounts to handle first, whether the 2FA and passkey steps cover items stored in the vault, the mSecure account’s own sign-in, or both, or whether to keep using mSecure for the new passwords. Those open questions are the ones customers raise in the forum thread. mSecure 7 can store passkeys and 2FA codes in the vault on its Essentials plan and above, so check whether you keep them there. The Hacker News notes the newest iPhone version of mSecure in Apple’s App Store at that time was 7.1.0, released October 23.