mSecure Password Manager Users Urged to Reset Passwords, 2FA and Passkeys After Unspecified Security Incident
mSeven Software, developer of the mSecure password manager, sent an email on November 3, 2026 to current and former customers warning of "suspicious activity" linked to the app and urging them to change passwords, reset two-factor authentication (2FA), and remove passkeys. The notification does not disclose what happened, which systems were affected, when the activity occurred, whether it has stopped, or how many users received it. As of the time of reporting, mSeven had not posted any public statement on mSecure's social media accounts, nor had staff responded to a customer thread discussing the email on the mSecure support forum.
Detalhes técnicos
mSecure can sync vault data via mSecure Cloud, Dropbox, iCloud, or Wi-Fi, and mSecure 7's Essentials plan and above can store passkeys and 2FA codes alongside passwords. The email does not clarify whether the recommended resets apply to data stored inside the vault, to the mSecure account login itself, or both, nor does it specify whether any particular sync method is implicated. mSeven states that vault data is encrypted client-side before syncing and that developers cannot access customer information; however, Germany's BSI (Federal Office for Information Security) reported in a December 2025 study that mSeven could, in theory, access stored data in mSecure 6.1.5 for Android — a finding limited to that specific version, which may not reflect later updates. The email does not confirm whether the suspicious activity involved vault data or encryption keys.
Remediação
The email presents password, 2FA, and passkey resets as optional possibilities without prioritization guidance or instructions on how to execute them, and it does not advise whether customers should continue using mSecure, including for storing newly changed credentials. Affected users should independently treat all vault-stored credentials as potentially at risk, reset 2FA/passkeys through each respective service, and monitor for further official communication from mSeven Software.
Linha do tempo
-
mSecure Password Manager Users Urged to Reset Passwords, 2FA and Passkeys After Unspecified Security Incident
ler a análise desta fonte ocultar
mSeven Software, developer of the mSecure password manager, sent an email on November 3, 2026 to current and former customers warning of "suspicious activity" linked to the app and urging them to change passwords, reset two-factor authentication (2FA), and remove passkeys. The notification does not disclose what happened, which systems were affected, when the activity occurred, whether it has stopped, or how many users received it. As of the time of reporting, mSeven had not posted any public statement on mSecure's social media accounts, nor had staff responded to a customer thread discussing the email on the mSecure support forum.
Technical Details
mSecure can sync vault data via mSecure Cloud, Dropbox, iCloud, or Wi-Fi, and mSecure 7's Essentials plan and above can store passkeys and 2FA codes alongside passwords. The email does not clarify whether the recommended resets apply to data stored inside the vault, to the mSecure account login itself, or both, nor does it specify whether any particular sync method is implicated. mSeven states that vault data is encrypted client-side before syncing and that developers cannot access customer information; however, Germany's BSI (Federal Office for Information Security) reported in a December 2025 study that mSeven could, in theory, access stored data in mSecure 6.1.5 for Android — a finding limited to that specific version, which may not reflect later updates. The email does not confirm whether the suspicious activity involved vault data or encryption keys.
Remediation
The email presents password, 2FA, and passkey resets as optional possibilities without prioritization guidance or instructions on how to execute them, and it does not advise whether customers should continue using mSecure, including for storing newly changed credentials. Affected users should independently treat all vault-stored credentials as potentially at risk, reset 2FA/passkeys through each respective service, and monitor for further official communication from mSeven Software.