Conclusion of password manager test by the german authority for security in IT at 2025:

Overall, the concept does not meet the standard expectations for password managers. Additional features reinforce these security concerns. Before using it, users should check whether they are willing to place the necessary trust in the manufacturer without any objective basis.

I should have read earlier!
I waste the day editing hundreds of passwords. At last, msecure will be deinstalled.

I have seen zero response .. they are either overwhelmed or have no idea what they are doing.. I am going to transfer to another password manager.. any tips? currently looking at Bitwarden

I am surprised and disappointed that the serious concerns expressed in this forum following mSecure's email today advising of a security breach have not received an official acknowledgement or reply.

It can be recognised that a threat like this will stretch your resources and you may not yet have the answers we seek, but it would be courteous to tell us that and undertake to provide updates at regular intervals, say every 2 hours, even if you have no news.  At least your user base will have some idea you care about us.

I don't understand how changing msecure password would solve the problem. 
If the problem is in the app until we get a new version changing the main password I think is useless.
If the problem is on their cloud because of syncing changing the main password would just be the 1st step and all the other entries we have should be changed too. 
But if everything is synced encrypted why would this be a problem also if someone accessed their servers ?

The email headers of the email I received seem legitimate and in my case the headers reported freshmail.io which is the internal email system of freshdesk.com a tool used by mSeven for customer care (according to AI).

Could it be that mSeven got hacked and this 3rd party ticketing system too got hacked and now if we change our main password they will have the key to decrypt our data ?

Am I wrong somewhere ?

OK, as others many questions.

I have never synced to the cloud, only between my devices. Am I still in danger?

WHICH versions of mSecure are affected? I use an older version! 

I did change mSecure password on all devices and all including Mac work and sync between them.

And agree, a despicably worded email with little to no  information. Will post this same in all threads I care to follow until we know more. I am not about to start changing 400 passwords.

I too have an older version on one phone, a newer version on my daughter's phone and we only sync to a home laptop over our personal home WiFi. I wish I knew how vulnerable I am as I have 355 passwords. I have only received two emails from mSecure that say the EXACT same thing yet they are formatted slightly differently. Once early this morning and another 2 hours ago. I was hoping  the latest one told me more info. When I changed my main password this morning I received a generic email for that too. I see not a single mSeven Software LLC representative has replied to any of the multiple media reports or any of these customer posts. That is quite telling that they made their money on us and now they don't want to deal with the cleanup as it isn't worth it to them, meanwhile all of us customers are in the dark. 

Telling us to "take steps" is not good enough.  The steps an average user might take could be more insecure than doing nothing.

• Do we become vulnerable when we log in?
• Does it involve an exploit that might give someone access to my device?
• Does the vulnerability/exploit give hackers visibility of data that is exported, if I chose to go that route?
• Does the absence of a CVE suggest that there's not a vulnerability in the application but that mSecure itself has been breached and passwords have become visible?
• Has the hole been patched?  Or is it ongoing?

I am switching to KeePassXC, which synces local to optional devices. Import was really easy with carefully structured data sets. Others cause some editing work.
It is open source and free. Good luck!

Yes, I also received this e-mail and unfortunately did not receive any replies. Is there somewhere where the support of msecure also gives more detailed answers??? Or is this just a way to drive users into some other subscription plan?

Disappointing stuff from MSecure - in the absence of reassurance I've had to assume everything compromised and changed all PWs and migrated off the platform. Hopefully it wasn't exposed but can't take the chance. 

I just got a response from mSeven. This involves a security breach that resulted in a copy of an encrypted database getting taken by an unauthorized person. They said the DB was encrypted and they have no evidence or information that points to that encryption being breached. The short of the details is the security concerns shouldn't apply if you don't use mSecure Cloud. From the email response: "Please note, this issue only pertains to users that were synching with the mSecure Cloud."

I don't want to speak for mSeven's support so open a ticket/send an email if you haven't already and they will get back to you, though it may take some time from my experience. I was getting ready to jump ship to a different product, and I may still do that, but for now I'm going to give them a couple of days in the hopes they will get more details released publicly and that this continues to sounds like it is only related to mSecure Cloud sync users (which I am not) and hasn't resulted in unencrypted data being exposed.