---
id: "CMP-202611-xrgn5v"
kind: "campaign"
aliases: []
title: "mSecure password manager incident: maker mSeven tells customers to change stored passwords, reset 2FA and remove passkeys after 'suspicious activity'; vault exposure unknown"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "mSecure", "fixed": [], "affected": "mSecure password manager (mSeven Software), all versions, scope unknown", "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T19:37:10+00:00"
updated_at: "2026-11-03T19:37:38+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:37:10+00:00"}]
---

# mSecure password manager incident: maker mSeven tells customers to change stored passwords, reset 2FA and remove passkeys after 'suspicious activity'; vault exposure unknown

On 3 Nov 2026 mSeven Software emailed current and former customers of the mSecure password manager saying it 'recently learned of suspicious activity associated with the mSecure password management application', started an investigation, took steps to mitigate and brought in outside cybersecurity experts. It recommends that customers immediately protect all confidential information stored in mSecure: change passwords, reset or re-enroll two-factor authentication, and remove existing passkeys. The email does not say what happened, when, whether it has stopped, how many customers are affected, or whether vault data or the keys protecting it were accessed. It also does not say whether the sync method (mSecure Cloud, Dropbox, iCloud, Wi-Fi) matters. Customers posted the email on mSecure's support forum. As of 18:00 UTC on 3 Nov mSeven had said nothing on its X or Facebook accounts. Reported by The Register, heise and The Hacker News.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:mSecure affected mSecure password manager (mSeven Software), all versions, scope unknown fixed ?

## How to check

Do you or your staff use mSecure (mSeven Software), any version, on any sync method? The real notice is an email sent 3 Nov 2026 in the name of mSeven Software. It starts 'mSeven Software ("mSeven") recently learned of suspicious activity associated with the mSecure password management application' and recommends 'changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys'. It ends with 'We regret any inconvenience that this may cause.' The sender address and any links are not given in the sources. Do not follow links in a forwarded copy; go to msecure.com or the app directly. mSeven's support contact is support@msevensoftware.com. Indicators of compromise: unknown.

## Fix

Assume anything stored in mSecure could be exposed. Starting with email, banking, cloud admin and other high-value accounts: change those passwords at each service, reset or re-enroll 2FA (TOTP seeds kept in mSecure), and remove and recreate passkeys stored in mSecure. Change the mSecure master password. Think about moving secrets to another manager until mSeven says what happened. Watch for phishing that pretends to be mSecure or mSeven about this incident.

## Timeline

- 2026-11-03T19:37:10+00:00 analyst

## Documents

- [describes] @TheHackersNews: ‼️ mSecure is urging customers to consider changing passwords, resetting 2FA, an https://x.com/TheHackersNews/status/2117690378015137979
- [describes] mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_