mSecure Security Incident: Reset Passwords, 2FA, Passkeys

Q: Which accounts should I reset first?

Start with your primary email, because it receives every reset link. Then move to banking, payments, and crypto; then work SSO and admin consoles; then 2FA seeds and passkeys; and finally everything else.

Summary

mSecure Flags Suspicious Activity, Stays Quiet on What Was Taken

Password manager mSecure has told current and former customers to change stored passwords, reset two-factor authentication, and remove passkeys. The reason given is suspicious activity. That is about all its maker has said about the mSecure security incident so far.

What Happened?

On November 3, developer mSeven Software emailed current and former mSecure customers about suspicious activity tied to the app. It says it opened an investigation, took steps to contain the issue, and brought in outside security experts.

The email leaves out the details that matter. It names no affected systems and gives no timeline. It does not say whether the activity has stopped, or whether vault data or encryption keys were touched.

Some customers posted the email on the mSecure support forum to ask whether it was phishing. By Tuesday evening UTC, no staff member had replied there.

Breach Notice · mSecure

One email. Zero answers on scope.

The November 3 email tells customers to reset almost everything in their vault. Here is what it confirms, and what it leaves out.

What the email says

✓Suspicious activity was linked to the app
✓An investigation is underway
✓Outside security experts were brought in
✓Sent to current and former customers
✓Change passwords, reset 2FA, remove passkeys

What it does not say

?Which systems were involved
?When it started, or if it has stopped
?Whether vault data or keys were reached
?Whether the sync method matters
?How many people were notified

When a vendor cannot say what was touched, the safe reading is that everything was.

What’s the Impact?

mSecure markets zero-knowledge, end-to-end encryption, so a “reset everything” notice is a heavy ask. It also isn’t the first time researchers have found security gaps in leading password managers.

A December 2025 study by Germany’s BSI found mSeven could, in theory, access data in mSecure 6.1.5 for Android, heise online notes. Until the scope is known, treat every vault entry as exposed.

The Questions Nobody Has Answered Yet

Does your sync method change your risk?

mSecure syncs vaults through mSecure Cloud, Dropbox, iCloud, or Wi-Fi. The email does not say whether the sync method you use makes any difference.

Did 2FA codes and passkeys leak with the passwords?

mSecure 7 can store 2FA codes and passkeys inside the vault. That raises a nasty possibility: if the vault leaked, the second factor may have leaked with the password.

Should customers keep using the app?

The email does not say whether customers should keep using mSecure, including for storing their new passwords. LavX News also flags the lack of detail on what was taken.

How to Avoid This

Good password hygiene matters most when a vendor goes quiet. Here is where to start:

Reset your primary email first, then banking, then work SSO and admin consoles
Re-enroll authenticator apps and recreate passkeys instead of only changing passwords
Change passwords on each service’s own site, never through links in incident emails
Keep 2FA seeds out of the same vault as the passwords they protect
Watch sign-in alerts and recovery settings on key accounts for the next 30 days

Response Order · Vault Reset

Reset in this order. Not alphabetically.

The notice gives no priority list. Start with the accounts that can reset all your other accounts.

Primary email

It receives every reset link. Lose it and you lose the rest.

Banking, payments and crypto

Direct money loss. New passwords plus fresh 2FA enrollment.

Work SSO and admin consoles

One login here can open cloud, code and customer data.

2FA seeds and passkeys stored in the vault

Re-enroll authenticators. Delete and recreate passkeys.

Everything else

Shopping, social, streaming. Still do it, just last.

Change each password on the service’s own site, never through a link in an email about the incident.

A Reset Is a Guess. Proof Is a Plan.

When a vendor won’t say what leaked, most teams rotate what they can find and close the ticket. Nobody checks whether the old credentials still work, which is the attacker’s question.

Secure.com can help map which stored credentials can reach email, cloud, code, and admin systems
The Red Teammate tests whether leaked or reused credentials still work, inside a scope you sign off on
Fixes go out as reviewable changes, each with a named human approver, backed by just-in-time privileged access
The same path gets tested again after the fix, so “resolved” means the way in is shut
Every step leaves an audit trail your board and auditors can read

Offense → Defense

Reset the vault. Then prove the door is shut.

A vault reset changes the secrets. It does not tell you whether an attacker could still get in with what leaked.

The usual loop

Self-checked

Vendor sends a vague notice

Team rotates what it can find

Ticket closed, dashboard turns green

Nobody tests the old credential again

The governed loop

Attack proven, fix proven

Map which credentials touch what

Prove which ones still work today

Fix with a named human approver

Re-attack the same door: Resolved

After any breach notice, ask one question: can the old key still open anything?

Frequently Asked Questions

What happened in the mSecure security incident?

On November 3, mSeven Software emailed current and former mSecure customers about suspicious activity tied to the app. It told them to change stored passwords, reset 2FA, and remove passkeys, but did not say which systems were affected or what data was accessed.

Was the mSecure breach email real or phishing?

Several customers asked on the support forum whether the email was phishing, since nothing appeared on mSecure’s website or social accounts at first. Multiple outlets have reported the notice. Either way, never click links in the email. Change passwords directly on each service’s own site.

Do I need to reset 2FA and passkeys, not just passwords?

Yes. mSecure 7 can store 2FA codes and passkeys inside the vault. If the vault was exposed, the second factor may have been exposed too, so re-enroll authenticator apps and recreate passkeys.

Which accounts should I reset first?

Start with your primary email, because it receives every reset link. Then move to banking, payments, and crypto; then work SSO and admin consoles; then 2FA seeds and passkeys; and finally everything else.

Should I keep using mSecure?

mSeven has not said whether customers should keep using the app, including for storing new passwords. Until it shares more about the scope, treat every vault entry as exposed and watch for an official update.

mSecure Tells Users to Reset Everything. It Won’t Say Why.