{"id":"CMP-202611-xrgn5v","kind":"campaign","aliases":[],"related":[],"title":"mSecure password manager incident: maker mSeven tells customers to change stored passwords, reset 2FA and remove passkeys after 'suspicious activity'; vault exposure unknown","description":null,"summary":"On 3 Nov 2026 mSeven Software emailed current and former customers of the mSecure password manager saying it 'recently learned of suspicious activity associated with the mSecure password management application', started an investigation, took steps to mitigate and brought in outside cybersecurity experts. It recommends that customers immediately protect all confidential information stored in mSecure: change passwords, reset or re-enroll two-factor authentication, and remove existing passkeys. The email does not say what happened, when, whether it has stopped, how many customers are affected, or whether vault data or the keys protecting it were accessed. It also does not say whether the sync method (mSecure Cloud, Dropbox, iCloud, Wi-Fi) matters. Customers posted the email on mSecure's support forum. As of 18:00 UTC on 3 Nov mSeven had said nothing on its X or Facebook accounts. Reported by The Register, heise and The Hacker News.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mSecure","fixed":[],"affected":"mSecure password manager (mSeven Software), all versions, scope unknown","ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Do you or your staff use mSecure (mSeven Software), any version, on any sync method? The real notice is an email sent 3 Nov 2026 in the name of mSeven Software. It starts 'mSeven Software (\"mSeven\") recently learned of suspicious activity associated with the mSecure password management application' and recommends 'changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys'. It ends with 'We regret any inconvenience that this may cause.' The sender address and any links are not given in the sources. Do not follow links in a forwarded copy; go to msecure.com or the app directly. mSeven's support contact is support@msevensoftware.com. Indicators of compromise: unknown.","fix":"Assume anything stored in mSecure could be exposed. Starting with email, banking, cloud admin and other high-value accounts: change those passwords at each service, reset or re-enroll 2FA (TOTP seeds kept in mSecure), and remove and recreate passkeys stored in mSecure. Change the mSecure master password. Think about moving secrets to another manager until mSeven says what happened. Watch for phishing that pretends to be mSecure or mSeven about this incident.","status":"open","published_at":null,"first_seen_at":"2026-11-03T19:37:10+00:00","triaged_at":"2026-11-03T19:37:10+00:00","updated_at":"2026-11-03T19:37:38+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '00':159B '18':158B '2026':35B '2fa':14A '3':33B,162B 'access':129B 'account':173B 'activ':20A,54B 'affect':118B 'also':131B 'applic':61B 'associ':55B 'authent':97B 'brought':70B 'campaign':28B 'chang':10A,87B 'cloud':140B 'cmp':24A 'confidenti':82B 'current':39B 'custom':8A,42B,78B,116B,147B 'cybersecur':73B 'data':122B 'dropbox':141B 'earli':30B 'early-warn':29B 'email':38B,103B,150B 'enrol':93B 'exist':100B 'expert':74B 'exposur':22A 'facebook':172B 'factor':96B 'fi':145B 'former':41B 'forum':155B 'hacker':181B 'happen':108B 'heis':178B 'icloud':142B 'immedi':79B 'incid':4A 'inform':83B 'investig':64B 'key':125B 'learn':51B 'maker':5A 'manag':3A,47B,60B 'mani':115B 'matter':146B 'method':138B 'mitig':68B 'msecur':1A,45B,58B,86B,139B,152B 'msecure':27A 'mseven':6A,36B,164B 'news':182B 'noth':167B 'nov':34B,163B 'outsid':72B 'passkey':17A,101B 'password':2A,12A,46B,59B,88B 'post':148B 'protect':80B,126B 're':92B 're-enrol':91B 'recent':50B 'recommend':76B 'regist':177B 'remov':16A,99B 'report':174B 'reset':13A,89B 'said':166B 'say':48B,106B,134B 'softwar':37B 'start':62B 'step':66B 'stop':113B 'store':11A,84B 'support':154B 'suspici':19A,53B 'sync':137B 'tell':7A 'took':65B 'two':95B 'two-factor':94B 'unknown':23A 'utc':160B 'vault':21A,121B 'warn':31B 'whether':110B,120B,135B 'wi':144B 'wi-fi':143B 'x':170B 'xrgn5v':26A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["msecure"],"ptokens":["msecure"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","first_public_at":"2026-11-03T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-xrgn5v","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T19:37:10+00:00","fetched_at":"2026-11-03T19:37:10+00:00","note":null}],"documents":[{"id":60046,"url":"https://x.com/TheHackersNews/status/2117690378015137979","title":"@TheHackersNews: ‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, an","kind":"post","source":"x","publisher":null,"text":"‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, and removing passkeys after reporting suspicious activity.\n\nBut were password vaults accessed? The company hasn't disclosed that.\n\nHere's what we know so far: https://t.co/hAeZJWX1t1 https://t.co/bHdFRYiiLP\n\nlikes 29 reposts 7","published_at":"2026-11-03T18:48:25+00:00","relation":"describes","confidence":null,"note":null},{"id":60130,"url":"https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html","title":"mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity","kind":"blog","source":"analyst","publisher":null,"text":"Email sent Nov 3 2026 in the name of mSeven Software to current and former mSecure customers: 'mSeven recently learned of suspicious activity associated with the mSecure password management application', launched investigation, took steps to mitigate, engaged external cybersecurity experts; recommends immediately protecting all confidential information stored in mSecure: changing passwords, resetting or re-enrolling 2FA, removing existing passkeys. Does not say what happened, when, whether it stopped, or whether vault data or keys were accessed. Text posted on mSecure support forum (support.msecure.com topic 36000038999). As of 18:00 UTC no post on mSecure X/Facebook, no staff reply. Sync options: mSecure Cloud, Dropbox, iCloud, Wi-Fi; email does not say if this matters. mSecure 7 can store passkeys and 2FA codes (Essentials plan+). Newest iOS version 7.1.0 (23 Oct). Also reported by The Register and heise.","published_at":"2026-11-03T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}