mSecure Tells Users to Change Passwords and Reset 2FA After “Suspicious Activity”
A password manager holds the keys to nearly everything in your digital life, so a warning from one is something to take seriously. On November 3, customers of mSecure received exactly that kind of message, and it left them with more questions than answers.
What happened
The developer, mSeven Software, sent an email to current and former mSecure customers saying it had recently learned of suspicious activity linked to the app. It urged people to consider changing their passwords, resetting two-factor authentication (2FA) and removing passkeys. A customer who received the email posted its text on mSecure’s support forum on November 3. According to the report, the company had said it started an investigation, took steps to limit the problem and brought in outside cybersecurity experts.
What we don’t know
The email is notably vague. It does not say what actually happened, which systems were involved, when the activity took place or whether it has stopped. It does not say whether anyone’s stored data was exposed, whether the activity reached vault data or the keys that protect it, or how many people received the message. It also does not clarify whether the 2FA and passkey advice applies to items stored inside mSecure, to the mSecure account’s own sign-in, or to both. As of the time of the report, the company had posted nothing about it on its social media accounts, and no staff member had replied in the support thread.
How mSecure is supposed to protect data
mSecure says vault data is encrypted on the customer’s device before it is synced, and that even its developers cannot read customers’ information. The app can sync through mSecure Cloud, Dropbox, iCloud or Wi-Fi, although the email does not say whether the sync method matters here. Version 7 can also store passkeys and 2FA codes alongside passwords on its Essentials plan and above, which makes the vault an even more valuable target.
There is one caveat. Germany’s Federal Office for Information Security (BSI) found in a study published in December 2025 that, in mSecure 6.1.5 for Android, the developer could in theory access stored data. The BSI tested only that version, and later updates may have changed the result. The report does not claim this has anything to do with the current incident.
What customers are being asked to do
The email presents its steps as possibilities rather than instructions. It does not say which accounts to handle first, how to carry out each step or whether people should keep using mSecure, including for storing their new passwords. That leaves users to work out their own priorities.
What you can do
Because the details are so limited, a cautious approach makes sense. If you use mSecure, check the company’s official channels for updates, since the situation may have changed after the original report. Consider changing the passwords for your most sensitive accounts first, such as email, banking and anything that can reset other accounts, and do it from a device you trust. Then replace any 2FA codes and passkeys that were stored in the vault, and turn on 2FA on those accounts if it isn’t already enabled. Watch your accounts for unusual sign-ins and be alert to phishing emails that may exploit the news. Anyone whose vault held 2FA codes or passkeys should treat those items as potentially exposed until the company says otherwise.
Final thoughts
Even a vague warning from a password manager should be taken seriously, because a successful attack on one can open many doors at once. This incident also shows why clear, prompt communication matters: when a company says only that it saw “suspicious activity,” users are left guessing. Until mSecure explains what happened, acting cautiously costs a little time, while ignoring the warning could cost much more.
Comments