Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

mSeven Software, the developer of the mSecure password manager, has advised customers to secure all confidential data stored in the app after detecting “suspicious activity.” The notice provides minimal technical details.

The email is dated November 3, 2026. It says mSeven “recently learned of suspicious activity associated with the mSecure password management application.”

The company says it launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts. Recipients are current or former customers.

The company recommends that users “immediately take steps” to protect their data. These steps “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.” The notice does not say what was accessed, when the activity began, or whether it has been contained, according to the mSecure support forum thread.

The mSecure support forum was filled with complaints within hours of the email. Users called the advice too vague to act on, and some said they hold hundreds of stored records.

One customer reported that other mSecure users he knows had not received the email and wondered whether it was phishing. The notice has not been independently confirmed beyond the company’s own support forum, so users should avoid clicking links in the email and go directly to the official site. Similar fake LastPass hack emails have already been used to spread malware, so impersonation is a real concern.

The forum discussion shows that key details are still missing. These include which systems were affected, whether encrypted vaults were accessed or exfiltrated, and whether key material such as Account Keys or authentication QR codes was exposed. It is also unclear whether the zero-knowledge design still holds.

Urges Users to Change All Stored Passwords

mSecure says vault data is encrypted locally before it syncs and that mSeven cannot read decrypted data. If that design held, an attack on server-side encrypted data would not automatically expose plaintext. The blanket reset advice suggests that mSeven either cannot rule out exposure or is being cautious.

One user reported that changing the account password rotated the QR code and key. He warned that attackers who stole vaults along with the old keys could still decrypt them offline. This is user testimony, not vendor guidance. Some users also criticized mSecure’s move to mandatory centralized cloud sync since version 6.

The 2022 LastPass breach shows the risk. Attackers downloaded encrypted vaults, cracked weaker master passwords offline, and kept using the stolen data for years.

Until mSeven publishes details, users should change the mSecure account password and confirm that the encryption key rotates. They should prioritize high-value accounts such as email, banking, cloud and crypto.

They should also re-enroll MFA on critical services, using one of the best multi-factor authentication providers, and review registered passkeys, as the vendor advises. Users should ignore links in emails and watch for phishing that copies the notice.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.