mSecure breach: encrypted Cloud database taken, customers told to change passwords, reset two-factor authentication and remove passkeys
mSeven Software warned current and former mSecure customers on November 3, 2026 that an unauthorised actor had acquired an encrypted copy of a database of mSecure Cloud users; the company reports no evidence the encrypted contents were accessed and has given no affected count.
What happened
mSecure is a password manager that stores passwords, passkeys, financial information and other sensitive data in encrypted vaults that can be synchronised across devices. On November 3, 2026, its maker, mSeven Software, emailed current and former customers to say it had recently learned of suspicious activity associated with the mSecure application, had quickly launched an investigation, taken steps to mitigate the issue and engaged external cybersecurity experts. The email itself did not say what systems were compromised, whether customer data was taken, or how many people were affected. In responses to customers that were later shared on mSecure’s support forum and reported by BleepingComputer on November 4, the company filled in the central fact: an unauthorised actor acquired an encrypted copy of a database containing information belonging to current and former mSecure users, taken from mSecure Cloud. mSeven says it has no evidence the actor accessed the confidential information stored inside the encrypted database, that it has taken additional steps to bolster security, and that it has no evidence the application is currently unsafe to use. It has not explained how the copy was taken, and BleepingComputer’s questions about the incident, the stolen database and the number of people affected had not been answered when it published.
Who is affected
Current and former mSecure customers who synchronised their password databases through mSecure Cloud, the company’s own sync service. The support responses draw the line there: “Please note, this issue only pertains to users that were synching with the mSecure Cloud” — people who only ever synced through Dropbox, iCloud or Wi-Fi sync between their own devices are outside the incident as the company describes it. The November 3 email went to all current and former customers, including people who stopped using the app years ago, because the database held information on former users as well. What sits in an mSecure vault is the most sensitive data a person owns — passwords, passkeys, two-factor authentication material and financial details — which is why the company’s protective advice is addressed to every current and former customer, not only Cloud users. mSeven has not given a count of affected users.
How serious
The concrete risk is account takeover through offline password cracking — not a confirmed loss of anyone’s passwords today. The copy that left was encrypted, and that distinction matters: mSecure uses AES-256 encryption with a zero-knowledge architecture that encrypts vault data on the user’s device before it is sent to the company’s servers, so mSeven says it cannot access customers’ decrypted vault contents, and it reports no evidence the attacker has accessed the confidential information inside the database either. But an encrypted vault in an attacker’s hands can be attacked at leisure, and a weak, short or reused master password can fall to offline guessing. BleepingComputer points to the 2022 LastPass breach as the precedent: attackers stole backups containing encrypted password vaults, and researchers later linked the breach to cryptocurrency thefts in which weak master passwords are believed to have been cracked. Until the passwords, passkeys and two-factor secrets in a Cloud-synced vault are changed, they should be treated as at risk in proportion to how strong the master password was. The nearer-term risk is phishing that rides the disclosure — fake “mSecure security” messages pushing a reset link are a standard follow-on to a breach announcement like this.
What to do now
Follow mSeven’s own advice, and do it inside the app or on a website address you type yourself — never through a link in an unexpected email. Change your mSecure master password to a long, unique passphrase you have not used anywhere else. Change the important passwords stored in the vault, starting with email, banking and the accounts that can reset everything else. Reset or re-enrol two-factor authentication for any account whose codes, secrets or backup codes were stored in mSecure, and remove passkeys stored in the app and create them again — the steps the company’s November 3 notice names. If you formerly synced through mSecure Cloud and no longer use the app, the same applies to any stored password you have not changed since: the company itself notes that deleting the app has no impact on this situation, because it cannot recall a database copy that has already left. Check any message claiming to be from mSecure about this incident against the notice in the app or on the company’s support site before acting on it.
Sources: BleepingComputer, November 4, 2026 · Tech Cheat Codes, November 5, 2026 (reporting mSeven’s November 3 customer notice and support responses)