mSecure Warns Users to Replace Stored Passwords

Password manager mSecure has warned current and former customers to protect confidential information saved in its app after the company detected suspicious activity. Because mSecure has not said whether stored passwords or other secrets were accessed, users must decide what to replace without knowing the incident’s full scope.

What happened

According to Malwarebytes Labs, mSecure developer mSeven Software emailed customers on November 3. The company said it had started an investigation, taken steps to limit the issue and brought in outside cybersecurity specialists.

The notice reportedly advised customers to act immediately to protect confidential information stored in mSecure. Suggested actions included changing passwords, resetting or enrolling two-factor authentication again, and removing existing passkeys.

However, mSeven did not disclose what the suspicious activity involved, when it happened, which systems were affected or whether anyone accessed customer vault contents. It also has not identified which customers, if any, face a confirmed risk.

Malwarebytes cautioned that changing only the password used to unlock mSecure might not be enough. Its report pointed to mSecure documentation warning that someone who previously obtained vault contents might already have made a backup. That documentation does not prove that such access occurred in this incident.

Who is affected

The warning applies to both current and former mSecure customers who stored confidential information in the password manager. The company has not disclosed a narrower affected group.

Users with passwords, two-factor authentication details or passkeys saved in mSecure should treat the notice seriously while the investigation continues. There is no confirmed statement in the source that every vault was exposed.

What to do now

1. List the most important accounts stored in mSecure. Start with accounts whose loss would cause the most harm. Malwarebytes recommends prioritizing critical accounts instead of waiting for the investigation to finish.

2. Open each service through its official app or a web address you type yourself. Go to its account, password or security settings and create a new, unique password. Do not follow unexpected password-reset links in email.

3. Review two-factor authentication. In each important account’s security settings, reset or re-enroll the second-factor method if its details were stored in mSecure. Save any new recovery information somewhere secure.

4. Review saved passkeys. Use the account’s security or passkey management page to remove an existing passkey if it was kept in mSecure, then create a replacement where appropriate.

5. Do not assume changing the mSecure master password completes the job. Replace the credentials for important services themselves, since Malwarebytes says a separate copy of vault contents could remain usable if one had already been made.

6. Consider storing replacement credentials elsewhere while details remain unclear. Avoid deleting or destructively resetting accounts; Malwarebytes specifically recommends making changes through the official services.