mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity

Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys.

The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but does not say what happened or whether anyone's stored data was exposed.

The email says it went to current and former mSecure customers. A customer who received it posted its text in a thread on mSecure's support forum on November 3.

As of 18:00 UTC on November 3, mSeven had posted nothing about the email on mSecure's X and Facebook accounts. No staff member had replied in that forum thread.

The email says mSeven started an investigation, took steps to limit the problem and brought in outside cybersecurity experts. It does not name the systems involved, say when the activity happened or whether it has stopped, or give the number of people who received the email.

mSecure can sync a customer's vault through mSecure Cloud, Dropbox, iCloud or Wi-Fi. The email does not say whether it matters which of these a customer uses.

mSecure 7 can keep passkeys and 2FA codes in the vault next to passwords, on its Essentials plan and above. The email's advice is about protecting information stored in mSecure. The email does not say whether the 2FA and passkey steps cover those stored items, the mSecure account's own sign-in, or both.

mSecure says vault data is encrypted on the customer's device before it is synced, and that even its developers cannot access customers' information.

In mSecure 6.1.5 for Android, mSeven could, in theory, access stored data, according to Germany's Federal Office for Information Security (BSI), which found this in a study published in December 2025. The BSI tested only that version, and its results may have changed with later updates.

The email does not say whether the suspicious activity reached vault data or the keys that protect it.

What the Email Asks Customers to Do

The email offers its steps as possibilities and does not say which accounts to deal with first or how to carry out each step. It also does not say whether customers should keep using mSecure, including to store their new passwords.

As of 18:00 UTC on November 3, the newest iPhone version of mSecure in Apple's App Store was 7.1.0, released on October 23.