mSecure tells users to change their passwords after an encrypted vault database was taken

On November 3, 2026, current and former customers of the mSecure password manager got a short, worrying email. It said its developer, mSeven Software, had “learned of suspicious activity” and recommended they “immediately take steps to protect all confidential information” stored in the app, which “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.” For someone with hundreds of logins saved, that’s a lot of work, and the email didn’t say why. A clearer picture has since come out. Here’s what is known, what isn’t, and a sensible order to work through it.

What happened

The first email didn’t say what systems were involved, when the activity happened or how many people were affected, as The Register and The Hacker News reported on November 3. Customers took their questions to mSecure’s own support forum, where some asked whether the email was even genuine.

Since then, customers who opened support tickets have been getting a longer statement, which several have shared on the same forum. In it, mSeven says that “an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users,” and that it “has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.” The statement adds:

• the issue “only pertains to users that were synching with the mSecure Cloud”
• deleting the app “will have no impact on this situation”
• mSeven has taken steps to bolster security and has “no evidence that mSecure is not currently safe for use”

BleepingComputer reported the same explanation on November 4 and said mSeven hadn’t answered its questions. As of November 5, mSeven hasn’t published a public incident page, said how the database was taken, or said how many people are affected.

How worried should you be?

mSecure says it encrypts vault data on your own device, with AES-256, before it syncs, so the company can’t read it. If that held, what was taken is a pile of scrambled vaults, and each one is only as strong as the master password that locks it. A long, unique master password makes an offline attack impractical. A short or reused one is much easier to guess, and an attacker who has a copy of the vault can keep trying for as long as they like.

That’s the lesson of the 2022 LastPass breach, BleepingComputer notes: encrypted vault backups were stolen, and researchers later linked crypto thefts to weak master passwords being cracked. mSeven hasn’t said whether anyone could decrypt its database, and it also hasn’t explained what else in the database, such as email addresses or account details, was readable without your master password.

So the honest answer is: there’s no sign your passwords were read, but you can’t rule it out yet, and how careful to be depends mostly on your master password.

What you can do

If you synced mSecure through mSecure Cloud, or aren’t sure:

1. Change your mSecure master password first, inside the app, to a long passphrase you’ve never used anywhere else. This protects your vault from now on. It doesn’t change the copy that was taken.
2. Change your most important passwords next: your main email accounts, your Apple or Google account, banking and payment services, and anything that controls other accounts, like a domain registrar or web host. Email comes first, because it can reset everything else.
3. Reset two-factor authentication where mSecure held the codes. If mSecure generated the six-digit codes for an account, turn 2FA off and on again for that account so the old secret stops working. Consider keeping those codes in a separate authenticator app.
4. Replace passkeys stored in mSecure. Delete the old passkey in the account’s security settings and create a new one.
5. Work through the rest at your own pace, oldest and least-used accounts last. It’s also a good time to delete accounts you no longer need.
6. Watch for fake “mSecure security” emails. Scammers often follow news like this with phishing. Act only inside the app or on a site you typed yourself.

If you synced only through iCloud, Dropbox or Wi-Fi, mSeven’s statement says you’re not part of this. Changing your master password is still a reasonable step until the company says more.

Should you leave mSecure? That’s your call. Whatever you use, look for a provider that publishes a clear incident report when something goes wrong, and make sure your master password is one you’d be comfortable having tested offline.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a phishing email that arrives at your password manager’s address but claims to be your bank is easy to spot. Frame never collects or stores the leaked records themselves.

Related coverage

• Lock down your Google and Apple accounts: passkeys, recovery and sessions: the step-by-step for two of the accounts to secure first.
• How infostealers steal your sessions, and why a new password isn’t enough: why signing out other sessions matters as much as the new password.

Sources

• The Register, Password manager mSecure tells users to change passwords, won’t say why, November 3, 2026
• The Hacker News, mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity, November 3, 2026
• mSecure Support forum, Important Security Notice Nov 3, 2026 (customer thread with the email text), November 3, 2026
• mSecure Support forum, More vital information about the mSecure incident (customer-shared mSeven support statement), November 2026
• BleepingComputer, mSecure password manager hack prompts password reset warnings, November 4, 2026