mSecure password manager breach — encrypted customer database stolen from mSecure Cloud; users urged to reset credentials
Severity: high · Patch status: no-fix-needed · Since 2026-11-04
mSeven Software notified current and former mSecure password manager customers on 2026-11-03 of suspicious activity in the mSecure application, later confirmed via support responses as theft of an encrypted customer database from mSecure Cloud. Only users who synced via mSecure Cloud are affected. The company says it has no evidence the attacker accessed decrypted vault contents, but stolen encrypted vaults enable offline brute-force of weak master passwords, as seen in the LastPass breach. mSeven has not explained how the breach occurred, prompting customer frustration over transparency. It urges customers to change passwords, reset/re-enroll 2FA, and remove passkeys, and says it has implemented additional security measures. No vendor patch applies; the incident is a data theft from the vendor's cloud.
What to do
- Change master password and all credentials stored in mSecure, prioritizing high-value accounts
- Reset or re-enroll two-factor authentication and remove existing passkeys
- Check accounts for unauthorized access, especially crypto wallets and financial services
- If using a weak master password, assume vault contents may eventually be compromised
- Consider migrating to another password manager or local-only vault until more details emerge
Sources
All live incidents on Threat Watch
