This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

If Secure is based on the West Coast of the US it's possible that the support team are still in bed ??

We are all having the same questions but no-one from msecure is responding !

Sending an email with vague information is bad enough, but failing to answer questions after such an email has been sent is even worse!

Don't think for a second that you can keep customers while behaving like this—I will definitely be cancelling my subscription.

they wont be in bed, they wil be taking this extremely seriously, I mean you did read the bit about regreting any inconvenience right 

MSecure, please share with us what has triggered this alert.  We realise you are investigating but the following would be really helpful so we know the severity of this

* was it compromised info found?

* was login a canary triggered?

* was it the msecure cloud backups show strange access logs

* was it an app library used contained malicious code?

* was source code identified as potentially malicious

*  WHAT CAUSED THIS ALERT!

What do you know right now?  This is utterly urgent and we need transparency and answers please.

I'm glad to always having only used the local WiFi-Sync method where my secure data is only stored locally on my devices. Never trusted cloud services. If this was a deep and successful breach, then they only have my mescure password but would need to breach my networks and devices in order to gain access to the local databases, which is practically impossible. 

Perhaps people who have hacked the email system...Who knows

To reiterate the question posted above by Stuart (good job Stuart!)

MSecure, please share with us what has triggered this alert.  We realise you are investigating but the following would be really helpful so we know the severity of this

* was it compromised info found?
* was login a canary triggered?
* was it the msecure cloud backups show strange access logs
* was it an app library used contained malicious code?
* was source code identified as potentially malicious
*  WHAT CAUSED THIS ALERT!

What do you know right now?  This is utterly urgent and we need transparency and answers please. 

WE NEED TO KNOW WHAT HAPPENED AS SOON AS POSSIBLE WITH AS MUCH DETAIL AS POSSIBLE

mSecure Security Incident — Customers Deserve Answers, Not Vague Warnings

I received your November 3, 2026, security notification, and frankly, I am furious—not simply because a security incident may have occurred, but because of the astonishing lack of meaningful information provided to your customers.

You are a PASSWORD MANAGEMENT COMPANY. Your entire business is built around protecting the most sensitive information your customers possess. We entrusted you with passwords, financial information, authentication credentials, recovery codes, and potentially passkeys because your company represented that this information was protected by strong encryption and a secure architecture.  Now you send an email telling customers to immediately protect everything stored in mSecure, including potentially replacing two-factor authentication methods and passkeys, while providing virtually NO explanation of what actually happened.

That is unacceptable.  I understand that an active cybersecurity investigation takes time. I do not expect you to disclose information that would compromise the investigation. But there is an enormous difference between withholding sensitive investigative details and leaving your customers completely in the dark about the security of their information.

I want direct answers to the following questions:

-WHAT WAS COMPROMISED? Was this an intrusion into your corporate infrastructure, your cloud synchronization systems, customer account databases, or the mSecure application itself?

-WAS CUSTOMER DATA ACCESSED OR EXFILTRATED? Do you have evidence that encrypted vault databases, customer records, or authentication information were downloaded or accessed without authorization?

-DID YOUR ENCRYPTION PROTECTIONS FAIL? You advertise a zero-knowledge security architecture using AES-256 encryption. Is there any evidence that encryption keys, decrypted vault contents, or other information capable of defeating those protections were exposed?

-WHY ARE YOU WARNING CUSTOMERS ABOUT TWO-FACTOR AUTHENTICATION AND PASSKEYS? This is perhaps the most alarming part of your notification. Are you aware of circumstances in which attackers could access these credentials, or is this simply an abundance-of-caution recommendation? There is a MASSIVE difference, and customers deserve to know which it is.

-WHEN DID THIS HAPPEN? When did the suspicious activity begin, when did your company first discover it, and how long could unauthorized access have continued?

-HAS THE THREAT BEEN CONTAINED? Have you positively established that the attacker no longer has access? Is it currently safe to use the mSecure application and synchronize vault information?

-WERE YOUR APPLICATIONS OR SOFTWARE UPDATE SYSTEMS COMPROMISED? Can customers trust that the versions of mSecure installed on their devices have not been modified or exposed to malicious code?

-WHO IS INVESTIGATING THIS? You mention outside cybersecurity experts. Who are they, and will you commit to releasing a meaningful technical incident report when the investigation is complete?

-WHAT IS YOUR COMMUNICATION PLAN? Will customers receive scheduled updates, even when an investigation is ongoing, or are we expected to wait indefinitely for another vague email?

I expect mSeven Software to provide a substantive public statement addressing these questions, rather than another generic reassurance that an investigation is underway.

Your customers deserve better. Much better.

what exactly has been compromised, and why are customers being told to replace potentially every credential they have stored?

OK, folks - by now, please stop repeating what others have said/demanded already to the fullest extent, thank you. This will help keep this thread less cluttered. 

MSecure, your notice asks us to change passwords, reset 2FA and remove passkeys, but it doesn't say what happened or what was affected. Nobody can rotate hundreds of credentials responsibly without that information, and there's still no official reply here.

Please answer:

1. What happened, when did it start, and is it contained?

2. Were vaults or encryption keys (Account Key, QR codes, hashes) accessed or exfiltrated, or is this precautionary?

3. Which sync methods are affected: mSecure Cloud, iCloud, Dropbox, WiFi Sync?

4. Does "reset 2FA / remove passkeys" mean only the mSecure account, or every account stored in the vault?

5. Is it safe right now to use mSecure to store new credentials, and does changing the mSecure password rotate the encryption key?

6. How can we verify this notice is authentic? Please publish an official advisory on msecure.com.

We need a substantive update today. Until then, many of us will treat our mSecure data as compromised.

Is the mSecure app on IOS leaking data? If so, changing passwords and entering the new ones in the app is not accomplishing anything. More details are needed!!