mSeven Software, the maker of the mSecure password manager, emailed current and former customers on November 3, 2026, warning of “suspicious activity” and urging them to protect everything stored in the app, according to the notice reproduced by customers on mSecure’s support forum. In follow-up support replies that customers have posted, the company says an unauthorized party took an encrypted copy of a database with information about current and former users who synced with mSecure Cloud. If you use or used mSecure, change your master password and your most important stored passwords, reset 2FA, and replace your passkeys.
What We Know About the mSecure Breach So Far
mSecure warned customers by email that it had detected suspicious activity, but it has not published a public statement explaining what happened. Here’s what’s known, based on first-party messages and early reporting from The Register and The Hacker News on November 3, 2026.
On November 3, mSeven emailed current and former customers a security notice about “suspicious activity.” The company said it launched an investigation, took steps to mitigate the issue, and engaged outside cybersecurity experts. It suggested steps that “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys,” but did not say what was accessed.
Starting November 4, customers began posting the replies they got from mSecure support on the company’s forum. Those replies say an encrypted copy of a user database was acquired, that there is “no evidence” the confidential information in it was accessed, and that the issue only affects users who synced with mSecure Cloud. mSecure’s notice did not say how many people are affected, when the activity started, or whether it has stopped.
Were mSecure Vaults Stolen?
mSecure has not publicly confirmed that customer vaults were stolen. Its support replies say an attacker acquired an encrypted copy of a database of user information, and that the company has no evidence the confidential information inside was accessed.
What is still unconfirmed:
- Whether the copied database contains full vault contents or account data only
- Whether any encryption keys were taken
- How many people are affected
- Whether users who synced only through Dropbox, iCloud, or Wi-Fi are at any risk
Treat the support replies as the best information available, not a final account. We’ll update this article if mSeven publishes more.
Why Change Passwords If mSecure Uses Zero-Knowledge Encryption?
Encryption protects a stolen vault only as long as no one can guess the master password that unlocks it. mSecure says vault data is encrypted on your device before it syncs, so a copied database should be unreadable on its own. But anyone holding an encrypted copy can try to crack it offline, guessing master passwords as long as they like without hitting a login limit.
That’s why a new master password alone isn’t enough:
- A new master password doesn’t protect an old copy. If a copy was taken, it stays locked by the master password you had at the time.
- Weak or reused master passwords are the main risk. A short password, or one used on another site that was breached, is far easier to crack than a long, unique passphrase.
- 2FA codes and passkeys can live in the same vault. On some plans, mSecure 7 can store 2FA codes and passkeys, according to The Hacker News. If a vault were ever decrypted, those would be exposed alongside your passwords. Resetting them removes that risk.
In short, changing the passwords, 2FA, and passkeys stored in the vault makes any copied credentials useless, even if the copy is cracked later. Secure notes, card numbers, and ID numbers in an old copy can’t be changed the same way, so watch the accounts they belong to.
Warning Signs of mSecure Breach Phishing
Scammers often follow a public breach with fake security emails, so expect messages that use the mSecure incident as a lure. These are the signs to watch for.
| Red Flag | Why It Matters |
| An email asking you to “verify” or re-enter your master password | A real breach notice won’t ask for your master password by email or link. |
| A link to a “secure your vault” or “reset now” page | Fake reset pages collect the new passwords you type. Open the app directly instead. |
| An attachment such as a “security tool” or “incident report” | Attachments in breach-themed emails are a common way to deliver malware. |
| Password reset emails or 2FA prompts you didn’t request | Someone may be trying your stored credentials on another account. |
| A sign-in alert from a new device or location | It can mean an account was accessed with an old password. |
What to Do Right Now: Steps for Current and Former mSecure Users
Start with your master password, then work through your most important accounts in order. Former customers who synced with mSecure Cloud should follow the same steps for any password they haven’t changed since.
- Decide where your new passwords will live. Choose your password manager before you start so you don’t save fresh credentials somewhere you don’t trust. If you stay with mSecure, change your master password first to a long, unique passphrase you’ve never used elsewhere.
- Secure your email first. Your email account can reset almost everything else, so change its password and review its recovery phone number and backup email.
- Change passwords for financial, work, and recovery accounts next. Do this through each service’s official website or app, using a unique password for each.
- Reset two-factor authentication. Turn 2FA off and back on to re-enroll your authenticator app, and generate new backup codes. This makes any 2FA secrets stored in an old vault copy useless.
- Replace your passkeys. Confirm you can still sign in another way, create a new passkey, then delete the old one in the account’s security settings. McAfee’s guide to how passkeys work explains why the old one should go.
- Work through the rest of your vault. Change remaining passwords by importance. Accounts you no longer use are a good time to close.
- Check for reused passwords. If a password stored in mSecure is also used anywhere else, change it on every site. Our guide to checking for password leaks shows how to see if any were already exposed.
What to Do If You Think an Account Was Already Accessed
If you see logins, password changes, or transactions you don’t recognize, act on that account before finishing the list above.
- Regain control of the account. Reset the password, sign out all other sessions, and remove devices or recovery details you don’t recognize.
- Call your bank or card issuer using the number on the back of your card if money moved or a financial account changed.
- Freeze your credit with Equifax, Experian, and TransUnion if personal or financial details were stored in your vault.
- Go to IdentityTheft.gov if someone used your identity to open accounts or make purchases. It creates a recovery plan for you.
- Keep records of alerts, emails, transaction details, and the dates you changed each credential.
Can Password Managers Be Hacked?
Yes. Password manager companies can be breached like any other, which is why encryption and a strong master password matter so much. The best-known case is LastPass, which disclosed in December 2022 that an attacker copied a backup of customer vault data. LastPass said sensitive fields stayed encrypted, but it advised customers with weaker master passwords to change their stored website passwords as a precaution.
A breached password manager is still not a reason to go back to reusing passwords. Reused passwords put every account at risk when any single website is breached. A password manager with a long, unique master password and 2FA turned on remains one of the most effective ways to keep accounts separate.
How to Report It
Report problems to the channels that match what happened:
- mSeven Software: submit a ticket at support.msecure.com with questions about your account.
- FBI Internet Crime Complaint Center: report account takeovers or financial losses at ic3.gov.
- Federal Trade Commission: report phishing emails or fraud at ReportFraud.ftc.gov.
- gov: report and recover from identity theft.
- Your local police, if you lost money.
Whatever mSecure discloses next, the priority is the same: change your master password, then your email, financial, and work passwords, and reset the 2FA and passkeys tied to them. Once those credentials change, copied credentials no longer open your accounts. Notes, card numbers, and ID numbers in an old copy can’t be changed, so keep watching the accounts they belong to.
FAQ
Was mSecure Hacked?
mSeven Software warned customers of “suspicious activity” on November 3, 2026. Support replies posted by customers say an attacker took an encrypted copy of a user database, though the company hasn’t published a public statement confirming that.
Is mSecure Safe to Use?
In support replies customers posted, according to BleepingComputer, mSeven reportedly said it added security measures and has no evidence the app is currently unsafe to use. It has not said this publicly. Whether to keep using it is your call. Either way, change your master password and key credentials now.
I’m a Former mSecure Customer. Am I Affected?
Possibly. The support replies say the copied database includes information about former users who synced with mSecure Cloud. Change any password you stored in mSecure that you still use, and reset 2FA and passkeys on those accounts.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
