Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two‑factor authentication (2FA) and removing passkeys.
mSeven Software's November 3 email to current and former customers
On November 3, an email sent in the name of developer mSeven Software informed current and former mSecure customers of "suspicious activity linked to the app." The message said the company had opened an investigation, taken steps to limit the problem and brought in outside cybersecurity experts. The email did not identify which systems were involved, when the activity occurred, whether it has stopped, or how many people received the notice.
A customer posted the text of that email to mSecure's support forum on November 3. As of 18:00 UTC the same day, mSeven had not posted the email or any update to mSecure's X or Facebook accounts, and no staff member had replied in the forum thread.
Specific actions the email suggests — and what it does not specify
The email offers possible steps for customers: changing passwords, resetting two‑factor authentication and removing passkeys. It frames these as options and does not provide a recommended order, nor step‑by‑step instructions for carrying them out. The message also does not say whether customers should continue using mSecure, including whether they should store newly created credentials back in the vault.
Crucially, the email does not say whether its recommended steps apply to items stored inside mSecure vaults, to the mSecure account sign‑in itself, or to both.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadSync methods, stored passkeys and mSecure's encryption claim
mSecure can sync a customer's vault through mSecure Cloud, Dropbox, iCloud or Wi‑Fi. The email does not indicate whether the risk is linked to any particular sync method or whether the choice of syncing affects the recommended actions.
The company notes that vault data is encrypted on the customer's device before it is synced and that even developers cannot access customers' information. At the same time, Germany's Federal Office for Information Security (BSI) reported in a December 2025 study that, in mSecure 6.1.5 for Android, mSeven could, in theory, access stored data. The BSI tested only that version and said its results may have changed with later updates. The November 3 email does not say whether the suspicious activity reached vault data or the keys that protect it.
App version detail and public communications status
As of 18:00 UTC on November 3, the newest iPhone version of mSecure available in Apple's App Store was 7.1.0, released on October 23. Despite the customer‑forum posting, mSeven had not posted the November 3 email to mSecure's X or Facebook accounts and had not replied in the forum thread by that time.
What this means for end users, security teams, and regulators
- End users: The email explicitly suggests changing passwords, resetting 2FA and removing passkeys — but it does not tell users which accounts to prioritize or whether to continue storing new credentials in mSecure.
- Security teams and IT managers: The notice and the BSI's December 2025 finding about mSecure 6.1.5 for Android provide distinct facts to reconcile: mSecure's statement that vault data is encrypted on device, and the BSI's theoretical ability for mSeven to access stored data in an earlier Android release. Teams will need to assess which app versions and sync methods their users employ.
- Regulators and oversight bodies: The company reports bringing in outside cybersecurity experts; regulators will note the absence of detail in the public notice about affected systems, scope and whether vault data or keys were compromised.
The message that reached customers is specific in its call to action but spare in the factual detail many will want: it tells users to consider changing passwords, resetting 2FA and removing passkeys, yet it leaves unclear which accounts are at risk, which sync methods (mSecure Cloud, Dropbox, iCloud or Wi‑Fi) matter, and whether the incident affected encrypted vault data or the keys that protect it. The company has said it has engaged outside experts and opened an investigation; until mSeven provides further, concrete technical detail, customers and administrators must weigh the recommended precautions against the unanswered specifics in the notice.
