mSeven Software, the maker of the mSecure password manager, emailed current and former customers on 3 November 2026. Text that customers quoted on mSecure’s own support forum says it “recently learned of suspicious activity” associated with the app. The notice asks them to protect everything stored in mSecure, which “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.”
The notice is short and gives no scope. This playbook turns it into an order of work for individual users and for the administrators who answer for staff who use the app.
- Suspicious activityYesmSeven says it learned of it and is investigating3 Nov 2026
- Mitigation and expertsYesmSeven says it took steps and engaged external cybersecurity experts3 Nov 2026
- Who received itYesCurrent and former mSecure customers3 Nov 2026
- What was accessedUnknownThe notice does not say3 Nov 2026
- Vault contents exposedUnknownThe notice does not say3 Nov 2026
How Reliable Is the Notice We Are Working From?
The notice reached customers by email. The copy we read is the text customers pasted into threads on mSecure’s own support forum, titled with the date 3 November 2026. Customers there asked whether the email is genuine, and some said they had not received it.
That uncertainty shapes the first step. Treat the email as a prompt to act, not as a place to act, and do every step below by opening the app or typing the address yourself. Phishers copy breach notices quickly, and a password manager is a prize target.
The notice does not say whether vault contents were exposed. Because it tells customers to protect “all confidential information stored” in the app, the steps below assume the stored logins are at risk. That is a precaution in line with the notice, not a finding about the incident.
What Should an mSecure User Do, in What Order?
The order puts the account that guards the vault first, then the sign-in factors, then the logins inside it, ranked by the damage they can do. Steps 1 to 4 follow the notice. The ranking in step 5 and the phishing guidance in step 6 are our advice.
- Open the app yourselfUse the installed app or type the mSecure address. Do not follow links in the email.
- Change the mSecure account passwordPick a long, unique passphrase that you have used nowhere else.
- Reset two-factor authenticationRemove the old method and enrol it again, as the notice allows.
- Remove passkeys, then register new onesThe notice does not say which passkeys. We would start with the passkey that signs in to mSecure, then any passkeys stored in the vault, and create them again once the account is secure.
- Rotate stored logins by blast radiusStart with email, then banking, domain and hosting, work single sign-on and cloud consoles.
- Expect follow-up scamsTreat any message about this incident that asks for a password or a code as phishing.
Email comes first among the stored logins because most other accounts send their reset links there. Our guide on responding to leaked credentials covers the wider routine, and the technique page on credentials from password stores explains why a vault is a target.
When you rotate a stored login, also end its active sessions where the service offers that option. A new password does not always sign out a browser that is already logged in. Turn on multi-factor authentication for each account as you go, and keep the second factor out of the vault it protects.
What Should Administrators Do for Staff Who Use mSecure?
An administrator may not know who uses the app, because staff often install a password manager on their own. The notice went to the email address on each mSecure account, so it may sit in a personal inbox and never reach the security team. Ask staff directly.
- Send a short internal message that names the app, quotes the notice and tells staff to act through the app, not through links.
- Ask each person who stores work logins in mSecure to rotate them, starting with single sign-on, email, cloud consoles and remote access.
- Rotate shared and service account secrets before individual logins, since several people may have copied them into personal vaults.
- Review the sign-in logs and the authentication-method registration log of your identity provider for the accounts involved, looking for new locations, new devices and new multi-factor enrolments after 3 November.
- Ask staff who used the same password elsewhere to change it everywhere, as credential reuse turns one exposure into many.
Steps 1 to 5 are our recommendations, built on the wording of the notice. Our glossary entry on the password manager explains the model, and the post on where passkey attacks actually land helps with the passkey step.
What Is Still Open?
Customers on the forum asked what was accessed, when it began, whether local-only vaults are affected and whether stored card details are at risk. The notice does not exclude local-only vaults, so users who keep one should still follow the steps above. We will update this page once mSeven publishes scope, a timeline or a technical account.
Until then, the cost of rotating is a few hours of work, and the cost of waiting is unknown. Do the steps in order, and start with the accounts that can reset all the others.