Threat watch / Breach
mSecure: password manager warns of "suspicious activity" without saying what happened
mSeven Software emailed mSecure customers that it had learned of suspicious activity linked to the app. It suggests changing passwords, resetting two-factor authentication and removing passkeys. The notice does not say what happened, when, or whether vault data was reached.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- mSecure
- How it happened
- Not public yet Checked 8 Nov 2026
- What was stolen
- An encrypted copy of a database, according to mSeven support replies shared by customers: "an unauthorized actor acquired an encrypted copy of a database". The replies say only users syncing with mSecure Cloud are concerned and that mSeven "has no evidence" the confidential data inside was accessed. mSeven has not published an official notice saying this.[3][4] Checked 9 Nov 2026
- Who was impacted
- Current and former mSecure customers received the notice. How many, and whether any account or vault was actually affected, is not public. mSecure says vault data is encrypted on the customer's device before syncing and that developers cannot access it.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- mSeven emails customers: it "recently learned of suspicious activity", has started an investigation, took mitigation steps and brought in external cybersecurity experts. A customer posts the text on the mSecure support forum. [1][2]
- As of 18:00 UTC, The Hacker News finds nothing on mSecure's X or Facebook accounts and no staff reply on the forum. The Register says mSeven had not answered its questions. [1][2]
- Customers share mSeven support replies saying an unauthorized actor took an encrypted copy of a mSecure Cloud database. BleepingComputer reports them; mSeven did not answer its questions. How the attacker got in is still not public. [3][4]