What Happened
The mSecure password manager hack came to light on November 3, when mSeven Software emailed customers to say it recently learned of suspicious activity linked to the app. The email was sent in the name of developer mSeven Software, and it urged recipients to protect confidential information they store in mSecure. BleepingComputer reports that the warning follows a cyberattack that reportedly exposed an encrypted customer database.
As an MSP owner, you need to take this seriously even if you do not recognize the product. Password managers are a single point of failure for client credential stores, and any reported exposure touches the accounts that live inside the vault. The fact that there is no CVE yet does not reduce the risk to the people who used the app.
Timeline
- November 3, 2026mSeven Software sent an email to mSecure customers saying it recently learned of suspicious activity linked to the app.
- November 4, 2026BleepingComputer reported that the warning follows a cyberattack that reportedly exposed an encrypted customer database.
Who Is Affected
Current and former mSecure password manager customers are affected. If you have an active mSecure account, the warning is aimed at you. If you cancelled the app but left data in place, the same warning applies.
Anyone who stored passwords, two-factor authentication secrets, or passkeys in mSecure should assume that data could be exposed. That includes MSPs who used mSecure to hold client credentials and clients who used it for personal accounts.
What This mSecure Password Manager Hack Means for MSPs
You have two jobs here: protect your own credentials and help clients protect theirs. Some clients will come to you because they saw the news. Others will not, and you may need to reach out if you know they use mSecure.
Think about any mSecure vault that you or your staff use to store client passwords, shared service accounts, or admin credentials. A credential store is only as safe as the accounts inside it, and a reported breach of the store means every credential in it should be treated as suspect.
Reach out to any client you know uses mSecure, even if their account is old. Former customers were named in the warning, and the data may still be in the old vault.
Technical Details
Public reporting on this incident does not include a CVE identifier, a specific version number, or a detailed attack vector. The only technical facts in the reporting are the ones mSeven Software put in its customer email and the follow-up coverage.
mSeven Software said it recently learned of suspicious activity linked to the app. BleepingComputer adds that the warning follows a cyberattack that reportedly exposed an encrypted customer database.
The product is mSecure, a password manager. Until the vendor publishes more details, the safest working assumption is that data from mSecure vaults was accessed without authorization.
What to Do This Week
Treat the mSecure app as compromised until mSeven Software says otherwise. These are the standard response steps for a credential store that has been exposed.
- Change the mSecure master password for every current and former customer account you manage or support.
- Change any other password you stored in mSecure, starting with accounts that use the same or similar passwords.
- Reset two-factor authentication for every account whose 2FA secret or recovery code was stored in mSecure.
- Remove any passkeys stored in mSecure, then re-enroll them directly through the services that use them.
- Turn on alerts or monitoring for the email addresses associated with mSecure accounts, if the services support it.
- Watch for phishing emails that use this warning as a hook, and tell clients to open the app or the vendor site directly.
What to Tell Clients
If you have ever used mSecure, treat the app as compromised. Change your mSecure master password now, and change any other password you saved in mSecure, starting with financial and email accounts.
Reset two-factor authentication for any account that had its 2FA code or recovery code stored in mSecure. Remove stored passkeys and set them up again directly with each service.
Do not click email links about this warning. Open the mSecure app or the vendor website directly. If an email asks you to enter your mSecure password, treat it as a phishing attempt.
Watch your accounts for unusual activity. Password managers hold long-lived credentials, and stolen data can be used long after the initial breach.
Frequently Asked Questions
What Happened With mSecure?
mSeven Software emailed mSecure customers on November 3 to say it recently learned of suspicious activity linked to the app. BleepingComputer reports that the warning follows a cyberattack that reportedly exposed an encrypted customer database. The only statement from mSeven Software so far is the customer email.
How Do I Know If I Am Affected?
The warning from mSeven Software was aimed at current and former mSecure customers. If you have an active mSecure account, or if you used mSecure in the past and your data is still in the app, assume your stored information may be at risk.
Should I Change Every Password I Stored in mSecure?
Yes, as a precaution. Start with the mSecure master password, then rotate passwords for email, financial, and admin accounts, then work through the rest. Reusing a password anywhere makes it more valuable to an attacker.
What Should I Do About Two-Factor Authentication?
Reset two-factor authentication for every account whose 2FA secret or recovery code was stored in mSecure. That means generating new codes, recovery codes, or authenticator enrollments directly with each service. Stored 2FA secrets are just another credential, and they may be exposed.
What Should I Do About Passkeys?
Remove passkeys stored in mSecure and enroll new ones directly with the services that use them. Passkeys are device-bound in many cases, but if they were synchronized through mSecure, treat them as potentially exposed.
I Am a Former mSecure Customer. Should I Still Act?
Yes. The warning from mSeven Software was addressed to current and former customers. If your old data still exists in the app, it is subject to the same risk, so change passwords, reset 2FA, and remove passkeys.
Sources
- mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious ActivityHackernews · Reported
- mSecure password manager hack prompts password reset warningsBleepingcomputer · Reported
What This Touches
Check these in your stack and your clients'.