KIungefiltert

· 4 min read · Auf Deutsch lesen

mSecure: Password manager advises a full reset and won't say why

mSeven reports "suspicious activity" linked to mSecure and advises changing passwords, re-enrolling 2FA and removing passkeys. It won't say what was affected. Here's what users should do now.

security

Translated from the German original with an AI language model, approved by me. Read the original

A password manager telling its customers to change more or less everything in the vault, without saying why. That's where the mSecure story stands right now.

What happened

On November 3, 2026, mSeven Software, the US developer of the mSecure password manager, emailed current and former customers. According to The Register, which has seen the email, the company "recently learned of suspicious activity" associated with the app. It says it launched an investigation, "took steps to mitigate the issue" and brought in outside cybersecurity experts.

Customers are told to "immediately take steps to protect all confidential information stored within" mSecure. The email lists possible steps: changing passwords, resetting or re-enrolling two-factor authentication (2FA, the second login step via code or app) and removing existing passkeys. Passkeys are cryptographic login keys that replace passwords.

What the email leaves out is the longer list. According to The Hacker News and heise, it doesn't say:

  • what the suspicious activity was or when it happened,
  • whether it has stopped,
  • whether vault data or the keys protecting it were affected,
  • which systems were involved or how many customers,
  • whether the sync option (mSecure Cloud, Dropbox, iCloud, Wi-Fi) matters,
  • whether the 2FA and passkey advice covers the mSecure account itself, the items stored in the vault, or both.

mSeven had not answered The Register's questions at the time of publication. On the support forum, customers with 500 or 800 stored passwords are asking whether they really have to change all of them. So far, nobody from the company has answered there.

What has changed since my post

Nothing of substance. As of today (November 4) I can't find any further statement from the vendor, and no CVE or patch tied to the incident. One correction to my post: the email frames the three steps as possibilities ("may include"), not firm instructions. In practice it still comes down to "everything", because nobody can say which entries are at risk.

Why it matters

mSecure advertises AES-256, end-to-end encryption and zero knowledge. In plain terms, data is encrypted on your device and the vendor shouldn't be able to read it. If that holds, a break-in at the vendor should leave vault contents largely safe. heise rightly points out that advising a full reset after an incident at the vendor raises the question of whether there are weaknesses in the encryption or secondary keys.

There's also an earlier finding. In December 2025, Germany's Federal Office for Information Security (BSI) reviewed ten password managers. For mSecure 6.1.5 on Android, it found that the vendor could theoretically access stored data, and that the overall design fell short of what people usually expect from a password manager (test.de). Only that version was tested. Whether it has anything to do with the current incident is unknown, and the two shouldn't be conflated.

Who is affected

Anyone who uses or has used mSecure. heise gives a rough sense of scale: over 500,000 installs on Google Play, plus roughly 250,000 iOS users estimated from App Store ratings. How many customers are actually affected is unknown.

What you should do now

As long as the vendor stays silent, I'd assume the vault contents are known to someone else.

  1. Email accounts first. Whoever has your inbox can reset passwords almost everywhere. New password, re-enroll 2FA, sign out all active sessions.
  2. Then banking, payment services and your Apple/Google/Microsoft account, followed by anything tied to money or identity.
  3. Re-enroll 2FA. If you kept TOTP codes (the six-digit codes from authenticator apps) in the vault, the secrets behind them are just as suspect as the passwords.
  4. Remove and recreate passkeys, especially ones stored in mSecure.
  5. Work through the remaining accounts by importance. With hundreds of entries it's tedious, but the order protects what matters most first.
  6. Watch out for phishing. An incident notice is perfect bait for fake "reset here" emails. Log in to sites directly, not through links in emails.
  7. Consider switching. A password manager that gives no details after an incident is losing the one thing it sells: trust. If you switch, create the new passwords directly in the new manager.

I'll update this article once mSeven says more.

Sources