Clients of the mSecure password supervisor are being urged to behave now to guard the confidential info they retailer in it, probably by altering passwords, resetting two-factor authentication (2FA), and eradicating passkeys.
The warning got here in an e mail despatched on November 3 within the identify of developer mSeven Software program. It says the corporate not too long ago realized of suspicious exercise linked to the app however doesn’t say what occurred or whether or not anybody’s saved information was uncovered.
The e-mail says it went to present and former mSecure clients. A buyer who obtained it posted its textual content in a thread on mSecure’s assist discussion board on November 3.
As of 18:00 UTC on November 3, mSeven had posted nothing concerning the e mail on mSecure’s X and Fb accounts. No employees member had replied in that discussion board thread.
The e-mail says mSeven began an investigation, took steps to restrict the issue and introduced in exterior cybersecurity consultants. It doesn’t identify the techniques concerned, say when the exercise occurred or whether or not it has stopped, or give the quantity of people that obtained the e-mail.
mSecure can sync a buyer’s vault by means of mSecure Cloud, Dropbox, iCloud or Wi-Fi. The e-mail doesn’t say whether or not it issues which of those a buyer makes use of.
mSecure 7 can preserve passkeys and 2FA codes within the vault subsequent to passwords, on its Necessities plan and above. The e-mail’s recommendation is about defending info saved in mSecure. The e-mail doesn’t say whether or not the 2FA and passkey steps cowl these saved objects, the mSecure account’s personal sign-in, or each.
mSecure says vault information is encrypted on the client’s gadget earlier than it’s synced, and that even its builders can not entry clients’ info.
In mSecure 6.1.5 for Android, mSeven may, in concept, entry saved information, in response to Germany’s Federal Workplace for Data Safety (BSI), which discovered this in a research printed in December 2025. The BSI examined solely that model, and its outcomes might have modified with later updates.
The e-mail doesn’t say whether or not the suspicious exercise reached vault information or the keys that shield it.
What the E mail Asks Clients to Do
The e-mail affords its steps as prospects and doesn’t say which accounts to take care of first or easy methods to perform every step. It additionally doesn’t say whether or not clients ought to preserve utilizing mSecure, together with to retailer their new passwords.
As of 18:00 UTC on November 3, the most recent iPhone model of mSecure in Apple’s App Retailer was 7.1.0, launched on October 23.
