mSecure Users Told to Change Passwords and Reset 2FA After Suspicious Activity

Customers of the mSecure password manager have been asked to act, but the company has not said whether any stored data was exposed.

mSeven Software emailed current and former customers of its mSecure password manager on November 3, warning of suspicious activity tied to the app without saying what happened or whether stored data was exposed. The company says it has launched an investigation, limited the problem and brought in outside security experts, but it has not named the affected systems, timing, or number of recipients. Customers are advised, as possibilities, to change passwords, reset two-factor authentication and remove passkeys. As of 18:00 UTC that day, the company had posted nothing on its X or Facebook accounts and no staff member had replied in a support forum thread where a customer shared the email. mSecure says vault data is encrypted on the device before syncing, though a German BSI study from December 2025 found that mSecure 6.1.5 for Android could in theory expose stored data, a result that may not apply to later versions.