Password manager mSecure told users to change passwords after hackers took its cloud database

mSeven Software sent a security notice on November 3 telling current and former mSecure customers to consider changing passwords, re-enrolling two-factor authentication and removing passkeys. The company said it “recently learned of suspicious activity” tied to the app. Replies it gave individual users, shared in its support forum, say an unauthorized party took an encrypted copy of a customer database from mSecure Cloud.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The notice itself is vague. The forum replies are not.

What mSeven has and has not said

In the notice, quoted by BleepingComputer, mSeven said it engaged external cybersecurity experts and took steps to mitigate the issue. It did not state which systems were hit, whether customer data was taken or how many users are affected. Its advice was to protect information stored in the app, which may include the credential changes above. The notice went to both current and former customers, which suggests the database covered people who had stopped using the app.

The detail comes from support replies that customers posted. One, in a thread on mSecure’s support forum, says mSeven learned that an unauthorized party obtained an encrypted copy of a database holding information on current and former users, that the company has no evidence the actor accessed the confidential information inside it, and that the issue only pertains to users who were synching with mSecure Cloud. It adds that deleting the app would not change the situation and that customers should routinely change their master password, sensitive stored passwords, two-factor methods and passkeys. A second forum discussion carries similar replies. BleepingComputer notes that mSeven had not answered its questions about the incident when the story was published.

Why an encrypted database still matters

mSecure says it uses AES-256 encryption and that the master password is not stored in the app or on its servers, claims set out on its product security page, which says the encryption has never been cracked and offers biometric unlock, auto-backup and cross-account sharing for premium and cloud users. Help Net Security’s September product showcase describes the design as zero-knowledge, meaning the vendor holds neither the account password nor an account key. Both descriptions are the vendor’s own and neither comes with an independent audit.

Under that model, a thief holding an encrypted vault has to guess the master password offline, with no lockout and no rate limit. A long, unique master password makes that guessing impractical; a short or reused one does not. That is the whole reason the notice pushes customers toward fresh credentials rather than waiting to see whether anything leaks. The reply in the forum is careful on this point: mSeven says it has no evidence the actor accessed the confidential contents, which is a statement about what it has seen so far, not a guarantee about what an offline attack could recover later.

Customers have not been satisfied. BleepingComputer reports complaints about the lack of detail and transparency in mSeven’s messages, and the company’s notice does not say how the intrusion happened. The forum reply also says mSeven has strengthened protections against future unauthorized activity and has no evidence the app is currently unsafe, though it offers no technical description of either step.

The app offers several places to keep a vault. Its product page lists mSecure Cloud, Dropbox, iCloud and local Wi-Fi, and Help Net Security adds that sync can be turned off for local-only storage. A user who never enabled mSecure Cloud falls outside the incident as mSeven describes it, which is why the sync setting is the first thing worth checking.

The LastPass precedent

BleepingComputer points to the 2022 LastPass breach as the pattern to worry about. Attackers there stole backups of encrypted vaults, and the blockchain analytics firm TRM Labs later traced continuing cryptocurrency thefts to it, in a report published in early January 2026. The BleepingComputer follow-up says more than $28 million was stolen and laundered between late 2024 and early 2025, with about $7 million more in September 2025, and that the U.S. Secret Service said in 2025 it had seized more than $23 million in crypto taken by decrypting vault data stolen in a password manager breach.

TRM Labs cautions that its link is based on correlating on-chain activity, not on tying thefts to individual LastPass accounts. Weak or reused master passwords were the believed weakness, and they could be cracked years after the breach.

For mSecure users, the practical question is which sync method they used. mSeven says only mSecure Cloud users are involved, while the product also syncs through Dropbox, iCloud and local Wi-Fi. One forum commenter asked whether backups reach the cloud, and no confirmed answer appears in the thread; that, and the number of vaults taken, are the details mSeven still owes customers. Until it publishes them, the safest reading of its own notice is the cautious one it chose: treat the credentials that were stored in a cloud-synced vault as exposed to offline guessing, and rotate the ones that matter most first.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.