Yes, the mSecure password manager was hacked, and its maker is telling users to change passwords, reset two-factor authentication and remove stored passkeys. mSeven Software, the company behind mSecure, emailed current and former customers on November 3, 2026 about suspicious activity involving the app. Security outlets later reported that a hacker stole an encrypted copy of a database from mSecure Cloud, the company’s sync service. The company says it has no evidence the attacker accessed the confidential information stored inside that encrypted database, but it is treating the incident as serious enough to ask every customer to act.
Quick Facts
| Product | mSecure password manager, made by mSeven Software |
| Notice sent | November 3, 2026, by email to current and former customers |
| What happened | An unauthorized actor acquired an encrypted copy of a database from mSecure Cloud |
| What was taken | An encrypted database containing information of current and former mSecure Cloud users |
| Evidence of access | Company says no evidence the attacker accessed confidential information inside the database |
| Who is affected | Only users who synced with mSecure Cloud |
| Who is not affected | Users who synced only through Dropbox, iCloud or Wi-Fi between their own devices |
| Company advice | Change passwords, reset or re-enroll two-factor authentication, remove existing passkeys |
| Encryption | AES-256, with a zero-knowledge design that encrypts data on the device before upload |
| Public incident page | None published by the company as of November 4 |
| User count | Not disclosed by the company |
| First reported | BleepingComputer, November 4, 2026 |
What mSeven Told Customers
The email from mSeven was short on detail and long on advice. It said the company had recently learned of suspicious activity associated with the mSecure password management application, had started an investigation, had taken steps to limit the issue, and had brought in outside cybersecurity experts to help. It did not say what systems were compromised, when the activity happened, whether it had stopped, or how many people were affected.
The advice in the email was direct. Customers were told to take steps to protect all confidential information stored in the app, which may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys. That is a broad instruction, and it covers nearly everything a password manager holds: the passwords themselves, the codes that prove identity, and the passkeys that replace passwords entirely.
Support replies shared by customers in the mSecure support forum added the key detail the email left out. According to those replies, an unauthorized actor obtained an encrypted copy of a database holding information about current and former mSecure users. The replies said the company has no evidence that the attacker accessed the confidential information stored inside that encrypted database, and that the issue only pertains to users who were syncing with mSecure Cloud.
What an Encrypted Database Theft Means
The word encrypted matters a lot here, but it is not a guarantee. mSecure says vault data is encrypted on the user’s device with AES-256 before it syncs, and that the company cannot read customers’ data because of its zero-knowledge design. If that design held, the stolen copy would be a locked box, and the attacker would still need each user’s master password to open any individual vault.
The risk is that a locked box can still be attacked. BleepingComputer pointed out that stolen password vaults can pose a serious risk if attackers can crack weak master passwords through offline attacks, where they try millions of guesses on their own computers without any lockout. That is what happened in the 2022 LastPass breach, when attackers stole backups containing encrypted password vaults and later cracked some of them. A strong, unique master password makes that kind of attack far harder, while a short or reused master password makes it far easier.
There is also an unanswered question about the design itself. A study by Germany’s Federal Office for Information Security, the BSI, published in December 2025, found that mSeven could in theory access stored data in mSecure 6.1.5 for Android, though the study tested only that version. The company has not confirmed whether encrypted vaults or encryption keys were taken in this incident, or whether its advice is precautionary. Until the company publishes a fuller account, users cannot know exactly what the attacker holds.
Who Is Affected and Who Is Not
The scope of the incident is narrower than the email list suggests. Support replies say the issue only pertains to users who were syncing with mSecure Cloud. If a person kept mSecure on a phone or computer and synced only through Dropbox, iCloud or Wi-Fi sync between their own devices, the support reply puts them outside the incident as described.
Deleting the app does not undo a copy that already left the cloud, according to the same support replies. The data is already out there, so the fix is not removal but rotation: change the master password, change the important passwords stored in the vault, reset two-factor authentication, and replace passkeys. The company also said it has taken additional security measures and has no evidence the mSecure application is currently unsafe to use.
As of November 4, mSeven had not published a public incident page with a user count, a dollar figure, or a technical explanation of how the copy was taken. It had also not posted about the incident on mSecure’s social media accounts, and BleepingComputer said the company had not yet answered its questions about the incident, the stolen database, and the potential impact on customers. Cyberattacks on financial services have also made headlines this week, including our report on the Credit Mutuel Arkea cyberattack and the 133 million dollar fraud claim.
What Users Should Do Now
Security practitioners give the same advice after a vault theft, and it starts with the accounts that can reset everything else. Change the passwords for email first, then the Apple ID, Google account or Microsoft account, then banking and payment logins. Those accounts can reset every other password a person owns, so they are the most valuable targets if a vault is ever opened.
Next comes the master password itself. Pick a long, unique passphrase that has not been used anywhere else, because the master password is the key that protects the vault on the user’s devices and any future cloud sync. Then reset two-factor authentication anywhere mSecure stored authenticator secrets or backup codes. If mSecure was generating six-digit login codes, turn two-factor authentication off and back on for those sites, and move the secret into a separate authenticator app. Passkeys stored in mSecure should be removed and set up again.
There is one more danger that follows every public breach: phishing. Scammers ride real headlines, and a message that pushes a secure reset link, a phone number, or a download is a separate attack. Users should go to the official mSecure site or app themselves rather than clicking a link in a message about the breach. The same caution applies to any large hack, as seen in our report on the Binance hack postmortem and the 6.34 billion dollar theft.
Why This Breach Stands Out
Password managers are supposed to be the safest place to keep secrets, which is why a breach at one draws so much attention. A vault holds the keys to the accounts it protects, and a theft of vault credentials cannot be undone by patching a server. The advice to remove passkeys is a sign of how seriously the company views the risk, because passkeys are meant to be the strongest form of login, and replacing them is a real chore.
The incident also fits a wider pattern in 2026. The same week brought news of a cyberattack on French blood bank cold rooms, covered in our report on the France blood banks hack and the freezers set to 110 degrees, and the mSecure notice arrived only days after the company says it learned of the suspicious activity. The speed of the customer email is a good sign. The lack of public detail is not. Users can only protect themselves on the facts they have, and right now those facts are thin: an encrypted database left the cloud, nobody outside mSeven can say whether any specific vault will ever be cracked, and the safest move is to act as if it might be.
Frequently Asked Questions
Was my mSecure password stolen?
Nobody has said passwords were stolen or decrypted, and the company says it has no evidence the attacker accessed the confidential information inside the encrypted database. What is confirmed is that an unauthorized actor took an encrypted copy of a database from mSecure Cloud. If your master password is strong and unique, an offline attack on your vault is far harder. If it is weak or reused, the risk is higher, which is why the company asks all Cloud users to change it.
Am I affected if I never used mSecure Cloud?
According to support replies from mSeven, no. The issue only pertains to users who synced with mSecure Cloud. If you synced only through Dropbox, iCloud or Wi-Fi between your own devices, the support reply puts you outside the incident as described. The company still recommends that all mSecure customers change their master password and vital stored passwords as a standard practice.
What should I change first?
Start with email, then your Apple ID, Google account or Microsoft account, then banking and payment logins, because those accounts can reset every other password. Then change your mSecure master password, reset two-factor authentication anywhere mSecure stored the secret, and remove and replace any passkeys stored in the app.
Is mSecure still safe to use?
The company says it has no evidence the mSecure application is currently unsafe to use and that it has taken steps to bolster security. Security outlets note that the advice to change passwords and reset two-factor authentication is precautionary while the investigation continues. Watch for an official update from the company before trusting the app with new passwords, and beware of phishing messages that use the breach as bait.
Sources
This article is based on reporting from BleepingComputer, The Hacker News, CyberInsider and TechCheatCodes. The BleepingComputer report is available at BleepingComputer, the TechCheatCodes report is available at TechCheatCodes, and the Skimwire report is available at Skimwire.
Final Thoughts
The mSecure incident is a reminder that even the tools built to keep secrets safe can become targets. An encrypted database left mSecure Cloud, the company has given customers little detail about how it happened or how many people are affected, and its advice is sweeping: change the master password, change the important passwords, reset two-factor authentication, replace passkeys. The encryption should protect most vaults, especially those guarded by strong master passwords, but the LastPass breach showed that stolen vaults can be cracked over time. For anyone who synced with mSecure Cloud, the right move is simple and urgent: rotate the keys that matter most, starting with email and banking, and do it now rather than waiting for the company’s next update.
