mSecure Breach: What to Do If You Use a Password Manager
If you use a password manager called mSecure, or used to, there is a notice you should know about. According to BleepingComputer, the company behind it, mSeven Software, emailed customers on November 3 about suspicious activity involving the app. It asked both current and former customers to take steps to protect what they have stored there.
Even if you use a different password manager, this is a useful moment to understand how these tools work and what a breach does and does not mean.
What happened
mSeven said it recently noticed suspicious activity, started an investigation and brought in outside security experts. The notice itself was short. It did not say which systems were affected, whether customer data was taken, or how many people were involved.
Replies from the company's support team, shared by customers and reported by BleepingComputer, filled in a little more. They indicate that a hacker stole an encrypted database from mSecure Cloud, the service that syncs a person's saved items across their devices. The company reportedly said the issue only affects people who were syncing through that cloud service. It also said it has no evidence the attacker got at the private information inside the database, and that it has added more security measures.
Customers have complained that the company has not explained how the break-in happened. mSeven had not answered BleepingComputer's questions at the time of publication.
Why change passwords if everything was encrypted
This is the question many customers are asking, and it is a fair one. A password manager is a locked digital box that holds your logins and other sensitive details. You open it with one master password. The company says your data is scrambled on your own device before it ever reaches their servers, so they cannot read it.
If that is true, a stolen copy should be unreadable. The catch, as BleepingComputer points out, is that a thief can take the locked box away and spend as long as they like trying to guess the master password on their own computers, with nobody watching. This is called an offline attack. A long, unusual master password makes that very hard. A short or common one makes it much easier.
BleepingComputer compared this to the 2022 LastPass breach, where attackers stole backups of encrypted vaults. Researchers later linked that breach to cryptocurrency thefts, and the attackers are believed to have cracked weak master passwords to get to stored logins and other secrets. That history is why the advice is to act now rather than wait and see.
What to do today
If you are or were an mSecure customer, work through these steps:
- Change your master password to something long and unique that you have never used anywhere else. A string of several unrelated words works well and is easier to remember than random symbols.
- Change the passwords stored in the vault, starting with the accounts that matter most: email, banking, your phone carrier, and any work logins. Your email comes first because it can be used to reset almost everything else.
- Reset your two-factor authentication. That is the second check, such as a code on your phone, that you pass after your password. The company says to reset or re-enroll these, so remove the old setup and add it again.
- Remove passkeys saved in the app and create new ones. A passkey is a login that replaces a password, tied to your device or account.
- Check any financial details or other sensitive notes you kept in the vault, and watch those accounts for activity you do not recognize.
Do this in order of importance rather than trying to finish everything in one sitting. Email and money first, everything else after.
If you use a different password manager
Nothing in this report says your tool was affected. Still, take five minutes to check that your master password is long and not reused, and that two-factor authentication is switched on for the manager itself. Those two settings do much of the protecting if a vault is ever stolen.
The bigger lesson
Security tools can tell you something went wrong, but they cannot do the cleanup for you. A breach notice is a to-do list: someone has to change the passwords, redo the two-factor setups and check the accounts that matter. Keeping up with updates, security warnings and notices like this one is easy to let slide when you are running a business or a household.
If that list feels like too much, handing the work to someone who deals with it regularly is a reasonable choice. Either way, no tool can promise your accounts are fully safe. What you can do is make them harder to break into and respond quickly when a company tells you there was a problem. If you have an mSecure account, today is a good day to start.
Source: BleepingComputer, published November 4, 2026.
If you would rather not do this alone, iFixediT can help: Fixie, our AI helper, answers first, and people help on paid plans.