This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

Please provide more context to your email below advising there has been a security breach.
It is not acceptable to offer the vague advice "take steps".
Please state what remedial action is required, and what data was compromised. 

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys. 

Agreed - This 'Important Security Notice' (sent to me/received on the morning of 03 Nov, 2026 at 0133mt)  is far too vague for anyone to take appropriate 'steps' to protect all confidential information stored within the mSecure password management application. You need to be far more open and explicit in regards to the level of threat and/or risk. 'Suspicious activity associated with the mSecure password management application' doesn't tell us much - Did a former employee use their (non-revoked) credentials to access a system? Are hackers currently exploiting a (now known) vulnerability? If you've taken 'steps to mitigate the issue' then why and what further steps would be necessary. With more than 800 records in my copy of mSecure, I desperately need to know what additional steps I need to take to secure the confidential information stored in mSecure!  Satisfied user/customer since 2013?

I know of two others who use Msecure, and neither of them has received this email. Is it phishing?

Glad to see this is already being raised as a problem.   First email I read upon waking up today and it's hopelessly vague.

Please provide more context about what is being recommended.  Has someone pinched our encrypted cloud data, our MSecure passwords, both, neither?

Wow, what a response from msecure! You had one job - use our software to protect your passwords, we're brlliant at it! Until we're not, then we will give out some useless info telling everyone we let your passwords be comprimised and we should take steps (whatever that means), but on the plus side we had to hire in experts and we regret any inconvenience.

maybe you should have had the cybersecurity experts you had to get in release the important security notice

Safe to say your going to lose buisiness over this

RE: Important Security Notice 2026-11-03 I agree with all other members who have eloquently expressed above all my questions and concerns. C'mon mSecure/mSeven; urgently give us more detailed information and guidelines before our trust and confidence is further eroded. 

Agree with all others - what kind of vague, ambiguous and unhelpful security announcement is this? It comes across as a corporate message that was only sent because of legal necessity (i.e. "saving their asses" ) and not for supporting their customers effectively. 

And this incident highlights exactly why it's never a good idea for a password manager app to force password management into a centralized system hosted online on one server.  Which msecure enforced starting from version 6. 

@Daniel - well I did change the password and it rotated the QR code and key, so that appears to work at least.

Still, if someone exfiltrated our stores and also compromised the old keys it won't matter - they can decrypt what they stole at their leisure.  I think.