-6.png?w=1024)
mSecure customers are being asked to protect the credentials inside their password manager, with advice that extends beyond changing a single master password.
Developer mSeven Software notified current and former customers on Nov. 3 after discovering suspicious activity associated with mSecure. The company recommended immediate protective steps that could include changing passwords, resetting two-factor authentication and removing existing passkeys.
Subsequent customer accounts of support replies point to the theft of an encrypted mSecure Cloud database. Whether attackers can read the information inside it remains a separate, unresolved question.
What mSecure has disclosed
In its email, reproduced by a customer on mSecure’s support forum, mSeven said it had begun investigating, taken mitigation steps and brought in outside cybersecurity experts.
The notice did not identify the cause, incident dates, number of affected customers or whether stored secrets had been exposed.
A customer later posted a support response attributed to mSeven stating that an unauthorized actor had obtained an encrypted database containing current and former users’ information. The response said the incident affected mSecure Cloud sync users and that mSeven had no evidence the attacker accessed the confidential information inside it.
BleepingComputer reported the same explanation on Nov. 4, citing customer-shared support responses. It also reported that mSeven said it had implemented additional security measures and had no evidence the mSecure application was currently unsafe to use.
That is the company’s assessment, rather than an independent assurance. The support responses provide more detail than the initial notice, but they are not a substitute for a full public incident report.
Changing the master password is only one step
A password manager’s master password and the credentials saved inside it serve different purposes. Changing the former does not automatically change the passwords used to sign in to email, banking or business services.
mSecure’s own account-protection guidance says those changes must happen through each service’s official app or website. That guidance describes general account recovery, rather than establishing what happened in this incident.
Understanding how password managers store and manage credentials helps explain why a response may involve several separate account changes.
Encryption also does not make a stolen database irrelevant. Depending on the design and secrets available to an attacker, a copied vault may allow attempts to crack its protection offline. That possibility does not establish that mSecure’s encryption has been defeated.
Which accounts customers should prioritize
While the investigation continues, a practical precaution is to start with accounts that could unlock other services or cause the greatest harm:
- Primary email and recovery accounts: Replace passwords through the official service and review recovery details and active sessions.
- Financial and work accounts: Use strong, unique replacements. Notify IT if mSecure contains company credentials so shared or privileged access can be reviewed.
- Two-factor secrets stored in mSecure: Consider re-enrolling affected authenticators through each service’s security settings, keeping a working recovery method available.
- Passkeys stored in mSecure: Establish another working sign-in method before revoking the old registration at the service and creating a replacement.
These are precautions, not evidence that every credential was exposed. Malwarebytes recommends prioritizing important accounts and considering a different password manager temporarily for replacement credentials. That suggestion is Malwarebytes’ precautionary advice; mSeven’s reported position is that it has no evidence the application is currently unsafe.
The warning also highlights why strong passwords alone cannot address every account-security risk. Recovery methods and authentication credentials need attention alongside passwords.
What businesses should establish before closing the incident
For IT teams, the first task is identifying whether employees used mSecure Cloud and which business accounts were stored there. Prioritize administrative, financial and recovery access, then record which passwords, authenticator registrations and passkeys have been replaced.
A migration alone does not invalidate credentials that may already have been copied. Likewise, switching sync providers cannot retrieve a previously stolen database. Teams should verify changes at the services themselves, review access logs for misuse and seek written clarification from mSeven about affected data and containment.
The incident does not establish a flaw in passkeys generally. Separate research into Google Password Manager’s synced passkeys illustrates why the security of the system holding authentication credentials matters alongside the sign-in method.
Before treating remediation as complete, organizations should seek details on whose data was involved, what protected it and how mSeven contained the incident. mSeven reportedly says it has no evidence the application is currently unsafe, but fuller technical disclosure would help teams assess the remaining risk. Meanwhile, replacing credentials for the highest-impact accounts and verifying those changes gives customers a concrete way to reduce risk.