The developer of the mSecure password manager has told current and former customers to change their passwords, reset two-factor authentication and remove passkeys after it learned of “suspicious activity” linked to the app. The warning email does not say what happened.
What the mSeven Software Warning Email Says and Leaves Out
mSeven Software emailed customers on November 3. The message says the company learned of suspicious activity linked to the app and urges recipients to take three steps: change passwords, reset two-factor authentication and remove passkeys.
The email gives no account of the event itself. It does not say what happened, which systems were involved, when it occurred, whether it has stopped, whether vault data was exposed or how many people received the message. It also offers no ranking of the three actions and no instructions for carrying them out.
Forum Post Is the First Public Trace of the Notice
A customer posted the text of the email in mSecure’s support forum on November 3. As of 18:00 UTC that day, mSeven had posted nothing on X or Facebook, and no staff member had replied in the forum thread. The company’s only stated actions are that it began an investigation, took steps to limit the problem and engaged outside cybersecurity experts.
How mSecure Says Vault Encryption Is Supposed to Work
mSecure says vault data is encrypted on the device before it syncs through mSecure Cloud, Dropbox, iCloud or Wi-Fi, and that even the developers cannot read it. If that design holds, a compromise of sync infrastructure alone would not by itself expose the contents of a vault. mSeven has not said whether the suspicious activity touched vault data or the keys that protect it.
The BSI Study of mSecure 6.1.5 for Android
Germany’s Federal Office for Information Security, the BSI, published a study in December 2025 that included mSecure. The agency said that mSecure 6.1.5 for Android could in theory allow mSeven to access stored data. Only that version was tested, so the finding does not describe the current release line, and it is not evidence of what happened in the latest incident.
Why the Passkey and 2FA Reset Instructions Stand Out
mSecure 7 can store passkeys and two-factor authentication codes alongside passwords. The newest iPhone build on November 3 was 7.1.0, released on October 23. That feature set matters for how the warning reads. A vault that holds passwords, one-time codes and passkeys in a single place gives an attacker who reaches it several ways into each account, which may explain why the email tells users to reset all three rather than only passwords.
The instruction also carries a practical burden. Customers who store their 2FA codes inside mSecure would have to re-enroll each account with the service in question, and anyone relying on passkeys held in the app would have to remove and recreate them. Without guidance on order or priority, users must decide for themselves which accounts to secure first.
Open Questions for mSeven and Its Customers
The scope of the incident is unknown. It depends on whether vault data or encryption keys were reached, and mSeven has not said either way. The notice went to former customers as well as current ones, which suggests the company considers old accounts or old data relevant, but the email does not explain that either.
Until mSeven publishes details, the available evidence is limited to the email, the company’s description of its encryption design and the older BSI finding on a single Android version. Password manager vendors typically face pressure to state whether encrypted vaults were copied, because that fact determines how urgent a master-password change is. mSeven has said it is investigating with outside experts, and customers are waiting on a statement that answers the questions its first message left open.
