mSecure password manager users urged to change passwords and reset 2FA

Customers of the mSecure password manager, made by mSeven Software, were sent an email on November 3 warning of suspicious activity connected to the app. The email suggested that users consider changing their passwords, resetting two-factor authentication (2FA, the extra code you enter after your password), and removing passkeys (a newer password-free way to sign in).

The email went to both current and former customers. It says the company opened an investigation, took steps to contain the problem, and brought in outside security experts. It does not explain what happened, when it happened, whether it has stopped, which systems were involved, or whether any stored data was exposed. At the time of reporting, the company had not posted about it on its social media accounts or answered a customer's question on its support forum.

mSecure says vault data is encrypted on your device before it syncs, so even its developers cannot read it. However, a December 2025 study by Germany's Federal Office for Information Security found that one older Android version, 6.1.5, could in theory let the developer access stored data. That study covered only that version, and later updates may have changed things.

For a small business, a password manager often holds the keys to email, banking, patient or client systems, and vendor portals. Because the warning is vague, the sensible approach is to act carefully, starting with your most sensitive accounts, rather than waiting for more details.