Ing. Calogero Bono
On November 3, mSeven Software, the company behind the mSecure password manager, wrote to current and former customers. It urged them to immediately protect all the information stored in the app by changing passwords and resetting 2FA and passkeys. The first notice explained nothing, then a second message mentioned the theft of an encrypted copy of a database. This matters because a password manager holds the keys to everything else, and those who use it need to understand how much work lies ahead.
A few terms before we get into the facts. Password manager is an app that keeps your credentials in an archive protected by a master password. Vault is that archive. 2FA is two-factor authentication, a second check beyond the password. Passkey is a credential that replaces the password and is tied to the device. HNDL stands for harvest now, decrypt later, meaning stealing encrypted data today in the hope of being able to open it in the future.
What happened to mSecure?
According to The Register, the November 3 email said mSeven had "recently learned of suspicious activity" linked to the app. The company says it has launched an investigation, contained the problem and brought in external security experts.
The message did not indicate which systems were involved, dates, or how many recipients there were. The same goes for the most important question, namely whether customer data was exposed.
What does mSeven's second notice say?
As TechRadar reports, a second statement, circulated on social media, describes an unauthorized party that acquired an encrypted copy of a database with information on current and former users. According to mSeven there is no evidence that it accessed the confidential data held in mSecure Cloud.
TechRadar puts it this way – someone took a copy of the database, and users who synced with mSecure's cloud are at risk. The company adds that deleting the app is not useful.
Is an encrypted database really safe?
In principle yes, but it is not an eternal guarantee. TechRadar recalls the HNDL practice, in which some criminals accumulate encrypted archives while waiting for a technical breakthrough. For this reason, the absence of evidence of decryption today does not close the question.
We have already written about this topic in our guide to encryption and data security. The strength of the master password matters greatly, because it is what protects the stolen archive.
Why are customers so angry?
The call to change everything, without details, has left customers in doubt. On the support forum one user wrote that they have over 800 saved passwords and asked whether they must change them all. On Reddit, according to TechRadar, another called the notice "absolutely insufficient".
According to The Hacker News, the email does not even clarify whether the 2FA and passkey steps concern the items stored in the vault, access to the mSecure account, or both.
Limits to know
Many points remain open. We don't know when the access happened, how many users are involved, or whether anything beyond the database has leaked. The Hacker News notes that mSecure claims on-device encryption, but that a study by Germany's BSI, published in December 2025, judged access to data theoretically possible in version 6.1.5 for Android. The test covered only that version. The report that the company deletes negative reviews on Google Play comes from a single unverified Reddit user.
What changes for those who work digitally
If you use mSecure with the cloud, start with the master password and your most sensitive accounts, such as banking, email and work tools. Then move on to 2FA and passkeys linked to those services. If you manage a company, check who on your team uses this program and ask for action on shared credentials. It doesn't need to be done in an hour. What you need is a prioritized list, and it's worth comparing alternatives in our password manager comparison.
Our take
The advice to change everything is prudent, but communicating it without explanations was a mistake. Those who sell trust must immediately provide scope, risk and priorities. The second notice improves things, but it came after complaints and downplays the matter with the formula of "no evidence". The fact remains that no password manager is immune, as the broken promise we already covered shows. Transparency and speed are what count.
Frequently asked questions
Did mSecure suffer a breach?
Yes, according to the second notice reported by TechRadar. An unauthorized party acquired an encrypted copy of a database containing data of current and former users.
Should I change all my saved passwords?
The company advises changing the master password and the vital ones. It doesn't set an order, so it's best to start with the most important accounts.
Does deleting the app help?
No, according to mSeven deleting the app doesn't improve the situation. The problem concerns those who synced with mSecure Cloud.
Has the stolen database been decrypted?
According to mSeven there is no evidence of access to confidential data. It is not a definitive confirmation, because the investigation is ongoing.
Are people who no longer use mSecure affected too?
They can be. The notice refers to current and former users, and the email was sent to both groups.
What to expect from mSeven in the coming weeks
The case is open, and the company's answers will decide whether customers stay. It's worth watching a few signals.
- Look for a technical report from mSeven with dates, systems involved and the number of users.
- Check whether app updates or confirmations about the use of cloud storage arrive.
- Consider migrating your data to another manager if explanations remain vague.
