Chat support available. Click the chat icon on the bottom right corner to start chatting with us right away!

Support mSecure

Base de connaissances Soumettre un ticket
Discussions > Have a question? > General Question
Commencer un nouveau sujet

Important Security Notice Nov 3, 2026

Please provide more context to your email below advising there has been a security breach.
It is not acceptable to offer the vague advice "take steps".
Please state what remedial action is required, and what data was compromised. 

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.
18 personnes se posent la même question

I am holding my powder dry.  If their email got hacked through a php zero day, this will blow over.  Meantime use this as an opportunity to do a security assessment, war game simulation.  With quantum computer decryption as a future possibility,  having a plan would be prudent.

For s secure service company to have the reported type of breach and not put it on their own website, i think it is just a scam. I dont believe it
I have just received the deeply disturbing mail as others in this thread, and have several essential questions: What happened? Which systems were affected, when did the incident begin, and when was it contained? Were customer vaults accessed or exfiltrated? Is there evidence of actual exposure, or is this still hypothetical? Was encryption key material compromised? Including Account Keys, authentication QR codes, encrypted keys or anything that could facilitate offline attacks. Does the advertised zero-knowledge architecture still hold? If so, what is the technical justification for recommending wholesale credential replacement? Why reset MFA and remove passkeys? Has mSeven identified a specific risk to stored authentication secrets, or is this a blanket precaution? Is mSecure Cloud currently safe? Can customers safely store newly rotated credentials, or could they be exposing them to an unresolved vulnerability? Does changing the mSecure account password actually rotate the underlying encryption key? If not, what remediation is necessary? Please provide feedback asap, your app and system are supposed to be safe and it is not a joke changing dozens of password across multiple accounts.

I am suspecting this to be a hack at the source code. No communictaing as they are still investigating. If teh source code is compromised they will likely have access to whatever you entered.
I have just blocked all of my credit and bank cards and I am changing the passwords. This cost me time but also money. Every piece of information that moves away from mscure is never returning. But what happened here can happen to all PW managers. I think I'll move back to an excel sheet.

Thank you for your warning.

Does this mean that I have to change every single password etc. in mSecure, or just the access to mSecure itself?
I am not a highly computer-literate young person and am very concerned .

I too received the same email early this morning. It appears too, that the mSecure app on my MAC is no longer working. The icon in the dock has a question mark superimposed over it and clicking on it does nothing.

image

Is does appear as though the app on my iPhone is still working fine.

Me too - Mac now isn't working but on the phone it is.  I did manage to do a bulk export of data


mSecure is working on my Mac but I'm as concerned as others above. The message received is entirely unacceptable.

I received the same security notice and share the concerns raised here. Before taking action on hundreds of credentials, could mSeven please clarify: - What systems or data were affected? - Is there any evidence that encrypted vault data was accessed or exfiltrated? - Are passwords, TOTP secrets, passkeys, secure notes, or credit card information potentially exposed? - Does the recommendation to reset 2FA and passkeys apply to all credentials stored in mSecure? - Is it currently safe to continue using mSecure to change and store new credentials? I would also appreciate regular updates here as the investigation progresses. Thank you.

Does this only apply when the mSecure cloud is used? How could anyone get access to a password database stored on a LAN?


The email is very unclear as to what our next steps should be and what the circumstances.


We need someone from mSecure on this thread.

Either respond with details MSecure or loose your customers. This is intolerable and will absolutely result in me leaving the platform if relevant technical details on the breach, steps to take (change hundreds of passwords and all 2fa blindly is not an acceptable response) and risk and exposure factors aren't properly communicated.

I am very concerned to get the warning, which I mistrust as it’s so vague! Can cleverer users explain how my data could be read in MSeven’s systems if I only synchronise my iPhone/Mac use of MSecure via iCloud and backup there also? MSeven say they don’t have a record of my app password… (I admit I am an essentials user, drifting to the included Apple PW manager) Thanks !

as mSecure seems to be located in US only, i would expect first answers in 2 or 3 hours. Even this fact is strange we received the mail today morning. But sure, there could be a 24/7 support as well who could sent it out.


I guess the biggest risk would be an insecurity in the mSecure app code

Connexion ou Inscription pour poster un commentaire