What mSeven has said
The email went to current and former mSecure customers. The Register, which saw the November 3 notice, reports that mSeven recently detected suspicious activity connected with the mSecure app, launched an investigation and took unspecified steps to contain the problem. The company also says it brought in outside cybersecurity experts.
The key advice is that customers should "immediately take steps to protect all confidential information" stored in mSecure. Those steps "may include" three things:
- Changing passwords.
- Resetting or re-enrolling two-factor authentication methods.
- Removing existing passkeys.
The notice ends with a short expression of regret for any inconvenience.
What it hasn't said
The notice gives no details on what kind of suspicious activity occurred, or whether attackers breached IT systems and how. It also gives no timeline and doesn't say which apps or users are affected. mSeven hadn't answered The Register's questions by publication.
Nothing in the material reviewed shows that vaults were stolen, that passwords were exposed or decrypted, or that customer accounts were accessed. This is not a confirmed breach of customer password data. It is a vendor warning with the reason left out.
Verifying the email is real
Phishing is a reasonable first worry, and customers asked about it. On mSecure's support forum, one user wanted to know whether mSeven or mSecure had actually sent it. A reply in the same thread says the message passed SPF, DKIM and DMARC checks for msecure.com. That is one forum user's header analysis, not a company statement. The same reply raised a remaining possibility: that someone broke into mSecure's own email-sending account. That is speculation, with no evidence behind it.
The forum thread itself reproduces the notice's text. This matters because mSecure published a blog post in September 2026 on spotting password manager phishing. It says that no legitimate password manager will ever ask for your master password. That is a sound rule for this episode. Don't enter your master password anywhere because of an email. Open the app you already have installed, or type the address yourself.
Why customers are angry
The questions on the forum are practical ones:
- Does the advice cover just mSecure, or every account referenced within it?
- Does it cover every passkey on devices where mSecure is installed?
- Is mSecure Cloud currently safe?
The Register quotes customers with more than 800 and more than 500 saved passwords asking whether they must change all of them. Those counts are the customers' own and haven't been verified. The ambiguity is the real problem. The notice doesn't say whether "passwords" means the mSecure account password, the credentials stored in vaults, or both. It also doesn't say whether the 2FA and passkey advice concerns mSecure's own login or other services.
Some customers also point to the product's pitch. mSeven advertises AES-256 encryption, end-to-end encryption and a zero-knowledge architecture, saying only users can access their data. mSecure's own support documentation says the account password and Encrypted Account Key (QR code) are not stored on mSeven's servers. If that design holds, a server-side incident wouldn't automatically expose vault contents. But nobody outside mSeven knows what the incident involved. Neither "your vault is safe" nor "your vault is compromised" is supported by anything public yet.
There is also some earlier context. Germany's Federal Office for Information Security (BSI) assessed mSecure in 2025, among other password managers. The BSI said that information on the concept, cryptography, security audits and third-party components isn't publicly available, which makes security investigations harder. It also said mSeven did not respond to its technical inquiries. That doesn't show the current incident is serious. It does explain why some customers want more transparency before they extend trust.
Why Windows users should care
mSecure has Windows, Mac, iOS and Android apps. The notice doesn't identify an affected operating system, app version or Windows-specific flaw. Windows users shouldn't assume they are more or less exposed than anyone else.
A cautious approach, with one warning
None of this is mSeven's instruction. It is general risk-based advice until the company says more.
- Don't reset your mSecure account. mSecure's support documentation says to reset only if you're locked out of every device. A reset erases all stored information and can't be undone. If you can still open the app, mSeven's own guidance is to change your password within the app instead. That covers biometric unlock too, including Windows Hello. The page says that after a password change you may need to reinstall the app on iOS, Android or Windows.
- Change the mSecure account password from inside the app, if you choose to. This is a documented procedure. The notice doesn't mandate it.
- Prioritize high-consequence accounts. Primary email, banking, work and admin logins, and anything used for password recovery come first. Rotate those through each service's official site or app.
- Check your 2FA and passkeys at the services that matter most, and only where they protect high-value accounts. Don't remove every passkey as a reflex. mSeven hasn't said that's required.
- Make sure you have a current backup of your vault. The documentation says backups stay protected by the account password in use when they were made. Old backups may become unreadable if you later reset after forgetting the password.
- Watch for phishing that follows the notice. Attackers like it when a real alert causes confusion.
What mSeven needs to answer
- What was detected, and when did it begin and end?
- Which systems were involved, including cloud sync?
- Were vaults, account data or key material accessed, copied or altered?
- Which users and app versions are in scope?
- Exactly which passwords, 2FA enrollments and passkeys should customers change?
A vendor can reasonably hold back details during an active investigation. Even so, an alarming notice with no scope leaves customers choosing between hours of reset work and gambling on the unknown. A short statement of what is and isn't believed to be exposed would settle most of the questions now filling the support forums.
I'll treat this as a developing story. Until mSeven publishes specifics, the reliable facts are that a warning was sent and its reason is unknown.