If you use mSecure and sync through mSecure Cloud, change your master password and the important passwords stored in the app, reset your two-factor authentication, and replace any passkeys. That is the advice in an email mSeven Software sent to current and former customers on Nov. 3.

mSeven has not published a notice on its website that we could find. The details here come from that email as quoted by customers in two mSecure support forum threads, and as reported by BleepingComputer. We have not seen the original email ourselves.

What to do

  • Change your master password.
  • Change the passwords you consider vital that are stored in mSecure.
  • Reset or re-enroll your two-factor authentication methods.
  • Remove existing passkeys and set up new ones. Our passkeys how-to covers the steps on iPhone and Android.

A support reply quoted in the forum says deleting the app would not change the situation.

What mSeven says happened

Per the forum posts, the statement says mSeven learned on Nov. 3 that an unauthorized actor obtained an encrypted copy of a database holding information about current and former mSecure users. It says mSeven "has no evidence that the unauthorized actor has accessed the confidential information." The statement calls the rotation advice standard best practice for all customers. Support replies say the issue "only pertains to users that were synching with the mSecure Cloud."

Who is affected

By the company's own wording, users who synced with mSecure Cloud. Neither the email as quoted nor the support replies say how many people that is, when the access happened, or how it happened. BleepingComputer says it asked mSeven for comment and had no reply when it published.

What we do not know

Nobody has said passwords were stolen or decrypted, and we are not saying so. mSecure says it uses AES-256 encryption and that data is encrypted on the device before upload, so it cannot read vault contents. BleepingComputer says the notice gives no details on which systems were compromised. BleepingComputer points out that encrypted vaults can still be attacked offline if a master password is weak, as in the 2022 LastPass breach. That is a general risk, not a finding about this incident.

Why it matters

The advice to rotate credentials, 2FA and passkeys is broad for a company that says it has no evidence of access. Until mSeven publishes details, following the steps costs little. For a similar rotate-everything case, see Railway env vars may be exposed: rotate every key now.