mSecure password manager breach prompts mass password-reset warning

On 3 November 2026, mSeven Software — the maker of the mSecure password manager — began warning customers to change their master passwords and reconfigure their security settings after what the company described as suspicious activity involving the application. mSecure stores passwords, passkeys and financial records in encrypted vaults that sync across devices, and the company markets the product on an AES-256, "zero-knowledge" design in which it cannot read the decrypted contents of a user's vault.

What mSeven disclosed

In a notice sent to customers, mSeven said it had identified "suspicious activity associated with the mSecure password management application," launched an investigation, mitigated the issue and brought in outside cybersecurity experts. The company urged users to change their passwords, reset or re-enroll two-factor authentication, and remove and re-add any passkeys. The official notice did not say when the intrusion occurred, which systems were affected, or whether customer data had been taken.

What may have been exposed

According to support replies that customers shared publicly, mSeven told affected users that an attacker had stolen an encrypted database from mSecure Cloud, and that the issue affected only accounts that synced with the cloud service. The company reportedly said it had found no evidence that the attacker accessed the confidential information held inside the encrypted database. mSeven has not publicly quantified how many users were affected, and no threat actor has been named.

Why it matters

Because the stolen material is described as an encrypted vault, its security rests on the strength of each user's master password. A sufficiently weak or reused master password can be attacked offline once an encrypted vault is in an adversary's hands — the same dynamic that turned the 2022 LastPass breach into a long tail of follow-on account compromises and cryptocurrency thefts. That is why mSeven's guidance centres on rotating credentials rather than simply trusting the encryption: users who change the passwords stored in their vaults, and especially those protecting cryptocurrency wallets and financial accounts, blunt the value of any copy an attacker may hold. Some customers criticised the company for not explaining publicly how the breach happened, and mSeven had not responded to press questions at the time of reporting.