This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

Had the same email and agree that it is way too vague. 

I have over 800 passwords in mSecure, is the email saying I need to change all of them!

Hi Stuart,

I received the same email by the sounds of it - the sender address looks legit. but the wording of the body of the email is not what I would expect from this company, it is vague, and raises questions.  I want to know whether mSeven or mSecure have actually sent it.  There is nothing on the announcement bar of the website or this support site.

Seriously now? mSecure is supposed to be secure, our data is supposed to be inaccessible! Now you say that our passwords, passkeys, 2FA, data may be breached? And change everything? Almost 1000 records? You need to provide more info about what happened.

I also recieved it. Does that means that CC informations that are saved are compromised as well? The email doesn't provide any details at all!

 I've got the same questions. Is it just mSecure login password that is compromised (I've now changed that) or do we need to assume that all the data contained within the password store has been stolen. Also can I continue to store new passwords within mSecure or is the hack ongoing? Until I know better I'm changing all my banking passwords and writing the new ones down.... Urgent clarification is needed...

Option Command + U on mac opens the full email and the hidden headers.  Opus 5.5 had this comment:

The email is genuine. It really came from mSecure, and it’s safe to have opened.

Why I’m confident:

It came from mSecure’s own mail system. Your mail server checked it, and it passed all three sender checks (SPF, DKIM and DMARC) for msecure.com. It was sent through SendGrid using mSecure’s own sending address, o1.sendgrid2.msecure.com. A scammer can’t forge that by just typing a fake “From” name. There’s nothing to click that could hurt you. There’s no login button, no “verify your account” link and no attachment. Every link goes to msecure.com, mSecure’s image server, or their official Facebook and Twitter pages. The reply-to address, msevensoftware.com, is the domain of mSeven, the company that makes mSecure. The sloppiness looks like a rushed real notice. Hidden in the email’s code is a note saying “draft, 2026-11-03 … Layout copied from the ‘New Sign In’ template … send as-is”. That’s someone at mSecure reusing their sign-in alert design in a hurry, not a scammer.

The one remaining possibility is that someone broke into mSecure’s own email-sending account. Even then, this message asks you to do nothing risky, so the outcome is the same either way.

You’re right to be bothered by how vague it is. It doesn’t say what was accessed, whether stored passwords were exposed, or whether your master password is at risk. But it tells you to change your passwords, reset your two-factor authentication and remove passkeys. That suggests mSecure can’t rule out that what’s stored in your vault was exposed. Until they say more, assume it was.

What I’d do, in this order:

Change your mSecure master password, inside the app. Change the passwords that matter most first: your email accounts, Apple ID, banking,  PayPal or other payment services, your domain registrar and web hosting. Re-set up two-factor authentication anywhere mSecure holds the codes. If mSecure generates your 6-digit login codes, the secret behind them may be exposed. Turn 2FA off and on again for those accounts, ideally moving it to a separate authenticator app. Remove and recreate any passkeys stored in mSecure. Work through everything else stored in mSecure after that. Watch for follow-up scam emails. Scammers often send fake “mSecure breach” emails after news like this. Only act through the app or a website you’ve typed in yourself.

My first step was to stop synchronizing. Does that mean, pw data are now in my own responsibility only? is there still an individual data pool to be hacked?
Or do you at mseven assume, customers data are already copied unauthorized an decrypted?

a clear answer is mandatory!

Christian

there is  now a reddit thread.  I am unable to post a url.  

my first move was to export everything as clear text csv onto a secure computer.  One could go further and encrypt that.  Second step is to msecure backup onto a secure computer.  Then change  my msecure password, reset 2fa.

With the csv, began building a triage spreadsheet to identify my security risks and priorities.  Meantime keep an eye out from m7software on how to navigate it.  Offhand, 1/3 of the entries need to be ditched as obsolete.

on the reddit thread, one msecure user said they never got the email.  Could be m7software mail system was hacked, nothing else compromised, and the email was sent to screw with people's minds.

So what is the answer? Is it genuine or do we not yet have confirmation from MSecure support?