mSecure password manager detects database breach and orders password changes

Full text

mSecure disclosed a breach involving an encrypted cloud database containing data from current and former users

Company urged users to rotate critical passwords, MFA methods, and passkeys despite no evidence vaults were decrypted

Customer criticism grew after limited initial disclosure left uncertainty about the incident’s scope and impact

Top password manager mSecure has confirmed it suffered a data breach and, “out of an abundance of caution”, and told its customers to simply reset everything, leaving some pretty upset.

On November 3 2026, the company behind mSecure, called mSeven Software, sent an email to its customers, saying it “recently learned of suspicious activity associated with the mSecure password management application”. It soon launched an investigation, mitigated the issue, and brought in third-party cybersecurity experts to assist.

The notice, while rather sparse on details, urged customers to “immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two factor authentication methods, or removing existing passkeys."

Encrypted database

All this was said without detailing what happened, and customers did not take it well. On Reddit, users were asking if this pertained just to the master password, or to all passwords stored inside the manager. Some people have hundreds of secrets locked away in mSecure, and changing all of them would take hours.

“This notice is wildly insufficient,” one user wrote. “Recommending potentially hundreds of credential changes without identifying the underlying threat, the affected customers, or the security of the application being used to make those changes is inadequate.”

mSecure allegedly responded with a follow-up notice that was also shared on social media. In it, it disclosed more details, and somewhat played down the actual breach:

“Yesterday, mSeven learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application,” it said. “Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.”

Putting it plainly, a threat actor walked away with a copy of the database that was sitting in mSecure Cloud, and all users - current and former - who had synced their password manager with the cloud service are at risk.

But mSeven tried to downplay the severity of the incident. Throughout the announcement, it repeated multiple times that the stolen database was encrypted and that there is no evidence that the threat actors managed to decrypt it. Truth be told, encrypted databases should be safe, but many criminals are still hoarding them, in case anyone makes a breakthrough at any point in time. There’s actually a name to the practice - HNDL (harvest now, decrypt later).

It also responded to user criticism about having to change all passwords now:

“As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices.”

Not the only password manager in trouble

Finally, mSecure said deleting the app won’t help the situation and stressed that the issue only pertains to users that were syncing with the mSecure Cloud.

“mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use,” it said. “Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support.”

How this reflects the company’s image remains to be seen. One Reddit user said the company was deleting negative reviews and complaints that were being left on the Google Play Store. But mSecure is hardly the only password manager experiencing an incident such as this one. In June this year LastPass confirmed losing sensitive customer data , while Dashlane said hackers obtained at least a dozen encrypted vaults.

Via The Register