mSecure Password Manager Hack: What You Should Do Now

mSeven Software, the company behind the mSecure password manager, is telling current and former customers to change their passwords, reset or re-enrol two-factor authentication, and remove any passkeys stored in the app. The company sent out a security notification on 3 November saying it had recently learned of suspicious activity linked to mSecure and had brought in outside cybersecurity experts to investigate.

The original notification didn't say what was accessed, whether customer data was actually taken, or how many people are affected. Some customers have since shared responses reportedly from mSeven's support team suggesting that an attacker stole an encrypted database from mSecure Cloud, containing information belonging to both current and former users. The same support responses say mSeven has no evidence that the attacker actually got into the confidential information inside that encrypted database, and that this issue only affects people who were syncing their vault with mSecure Cloud.

None of this is confirmed in an official public statement from mSeven itself, so treat the detail as less solid than the headline warning. mSeven has reportedly said it's added extra security measures and has no evidence the app is currently unsafe to use.

What this actually means for you

If you don't use mSecure, this doesn't involve you. No action needed.

If you do use mSecure, the key question is whether you had cloud syncing turned on. The reports so far point to mSecure Cloud specifically, not the app in general. But since mSeven itself hasn't fully clarified the scope, the cautious approach is to treat this as relevant if you're an mSecure user at all, past or present.

mSecure says it uses AES-256 encryption with a zero-knowledge design, meaning your vault is encrypted on your own device before it ever reaches mSeven's servers, and the company says it can't see your decrypted data. That's a genuinely important protection. It's also worth being honest about its limits: an encrypted database stolen by an attacker can, in principle, be attacked offline given enough time, especially if the master password protecting it is weak. This is roughly what researchers believe happened after the 2022 LastPass breach, where stolen encrypted vaults were later linked to cryptocurrency thefts, apparently through cracking of weak master passwords. We don't know that anything similar is happening here. It's context, not a prediction.

What to do if you use mSecure

• Change your master password. Pick something long and genuinely unique, not reused anywhere else. This is the single most important step, because a strong master password is what stands between an attacker and your encrypted vault even if that vault was copied.
• Change the passwords stored inside your vault, starting with anything important: email, banking, your main cloud accounts.
• Reset or re-enrol two-factor authentication on your important accounts, as mSeven has advised.
• Remove and re-add any passkeys you'd stored in mSecure.
• Watch for phishing. Anyone contacted "about this breach" by email should be wary of links asking them to "verify" or "confirm" their account. Go to the official mSecure app or website directly instead of clicking through an email. You can check a suspicious message at /tools/scam, or check a link before opening it at /tools/url.

If you're setting new passwords anyway, it's worth checking whether any of them have already turned up in a known data breach. Our free password checker at /tools/password does this entirely in your browser, nothing you type is sent to us or anyone else.

What this does not fix

A VPN does not protect a password vault sitting on a company's servers, and it won't stop this kind of breach or undo it. A VPN encrypts your internet connection as it travels, it has nothing to do with how a password manager stores or secures your data once it reaches their systems. If you're affected by this, the fix is changing your passwords and resetting your 2FA, not turning on a VPN.

It's also worth being honest that we don't yet know the full scope of this incident. mSeven hasn't published full details, and much of what's circulating comes from individual support replies rather than an official statement. If more facts emerge, including from mSeven directly, that could change the picture. Until then, the sensible move for mSecure users is the same regardless: change your passwords, reset your 2FA, and keep an eye out for phishing attempts that try to use this incident against you.