Chat support available. Click the chat icon on the bottom right corner to start chatting with us right away!

Soporte mSecure

Base de conocimientos Foros Enviar un ticket
Discusiones > Have a question? > General Question
Empezar un tema nuevo

Important Security Notice 2026-11-03

This seems ominous:


Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.


500+ passwords, lot of changing.  This will require a triage.


 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?


all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?


If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?




8 personas tienen esta pregunta

Please provide more context to your email below advising there has been a security breach.
It is not acceptable to offer the vague advice "take steps".
Please state what remedial action is required, and what data was compromised. 

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys. 

We need to know if we should assume our mSecure password is compromised or the passwords we store in mSecure or both. Tell us what is at risk so we can plan what to do. “Take Steps” is too vague.

Agreed - This 'Important Security Notice' (sent to me/received on the morning of 03 Nov, 2026 at 0133mt)  is far too vague for anyone to take appropriate 'steps' to protect all confidential information stored within the mSecure password management application. You need to be far more open and explicit in regards to the level of threat and/or risk. 'Suspicious activity associated with the mSecure password management application' doesn't tell us much - Did a former employee use their (non-revoked) credentials to access a system? Are hackers currently exploiting a (now known) vulnerability? If you've taken 'steps to mitigate the issue' then why and what further steps would be necessary. With more than 800 records in my copy of mSecure, I desperately need to know what additional steps I need to take to secure the confidential information stored in mSecure!  Satisfied user/customer since 2013?

I know of two others who use Msecure, and neither of them has received this email. Is it phishing?

Glad to see this is already being raised as a problem.   First email I read upon waking up today and it's hopelessly vague.


Please provide more context about what is being recommended.  Has someone pinched our encrypted cloud data, our MSecure passwords, both, neither?


I agree with other members who have raised concerns. Please supply more specific information. Have UK authorities been contacted?

Wow, what a response from msecure! You had one job - use our software to protect your passwords, we're brlliant at it! Until we're not, then we will give out some useless info telling everyone we let your passwords be comprimised and we should take steps (whatever that means), but on the plus side we had to hire in experts and we regret any inconvenience.


maybe you should have had the cybersecurity experts you had to get in release the important security notice


Safe to say your going to lose buisiness over this

Cmon guys. Respond with more info.
The central question is simple: What exactly has been compromised, and why are customers being told to replace potentially every credential they have stored? According to mSecure's published security model, vault data is encrypted locally before synchronisation, and mSeven claims it cannot access customers' decrypted information. If that architecture has operated as advertised, a server-side incident involving encrypted vault data would not automatically mean the contents were exposed in plaintext. So WHY is mSeven recommending password changes, MFA resets and even passkey removal? I expect mSeven to provide more specific details within 24 hours, or I will cancel my subscription. Please answer the following questions: 1. What happened? Which systems were affected, when did the incident begin, and when was it contained? 2. Were customer vaults accessed or exfiltrated? Is there evidence of actual exposure, or is this still hypothetical? 3. Was encryption key material compromised? Including Account Keys, authentication QR codes, encrypted keys or anything that could facilitate offline attacks. 4. Does the advertised zero-knowledge architecture still hold? If so, what is the technical justification for recommending wholesale credential replacement? 5. Why reset MFA and remove passkeys? Has mSeven identified a specific risk to stored authentication secrets, or is this a blanket precaution? 6. Is mSecure Cloud currently safe? Can customers safely store newly rotated credentials, or could they be exposing them to an unresolved vulnerability? 7. Does changing the mSecure account password actually rotate the underlying encryption key? If not, what remediation is necessary? mSeven cannot reasonably issue such an alarming notice without explaining the underlying threat and the actual scope of necessary remediation ESPECIALLY given the promises of the Zero-Knowledge system design. This is not just a technical failure, it is a massive communications blunder on mSeven's part that undermines our trust in your services.

RE: Important Security Notice 2026-11-03 I agree with all other members who have eloquently expressed above all my questions and concerns. C'mon mSecure/mSeven; urgently give us more detailed information and guidelines before our trust and confidence is further eroded. 

Agree with all others - what kind of vague, ambiguous and unhelpful security announcement is this? It comes across as a corporate message that was only sent because of legal necessity (i.e. "saving their asses" ) and not for supporting their customers effectively. 


And this incident highlights exactly why it's never a good idea for a password manager app to force password management into a centralized system hosted online on one server.  Which msecure enforced starting from version 6. 

Iniciar sesión o Registrarse para publicar un comentario