Is mSecure Safe After Its November 2026 Security Warning?
By Ashikur Rahman14 min readQuick answer: Nobody outside mSeven Software can say yet whether mSecure is safe, because the company has not said what happened. On 3 November 2026 it told current and former customers it had found "suspicious activity" and recommended changing passwords, resetting two-factor authentication and removing passkeys stored in the app. Support replies shared by customers say an encrypted mSecure Cloud database was stolen and that only Cloud sync users are affected, but mSeven has not published that itself. mSecure's design should make a stolen database alone very hard to read, because each vault is locked with a 46-character key the company says it never stores. The safe move is still to follow the advice: start with your email, bank and other accounts that can reset everything else.
What did mSecure tell its customers?
The notice went out by email on 3 November 2026, and it is short. BleepingComputer, The Register and Malwarebytes all published the same text. It opens: "mSeven Software ("mSeven") recently learned of suspicious activity associated with the mSecure password management application." It goes on: "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist." And: "You are receiving this email because you are a current or former mSecure customer."
The instruction follows: "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application." It adds: "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." It closes: "We regret any inconvenience that this may cause."
What the email leaves out is the problem. It does not say what the suspicious activity was, when it happened, which systems were involved, how many people were affected, or whether anyone read stored data. It went to former customers too, which suggests the affected data includes accounts that are no longer active. For a password manager, a notice that asks you to replace everything without saying why is about the hardest kind of warning to act on.
What customers were told afterwards
Customers who wrote to support began posting the replies they got. According to replies shared on mSecure's support forum and reported by BleepingComputer, a hacker stole an encrypted database from mSecure Cloud containing information about current and former users. One reply reads: "Please note, this issue only pertains to users that were synching with the mSecure Cloud." The replies also reportedly said mSeven had no evidence the attacker accessed the confidential information inside the database, and no evidence the app is currently unsafe to use.
Treat those details as reported, not confirmed. Malwarebytes, which updated its own article after the replies appeared, wrote: "We have not located a directly published company statement confirming that scope." Neither have we, as of 10 November 2026.
What is known, and what is not
| Question | Answer as of 10 November 2026 | Source |
|---|---|---|
| Did something happen? | Yes, "suspicious activity associated with the mSecure password management application" | mSeven email, 3 November |
| What was it? | Not stated publicly | None |
| Was a database taken? | Reported: an encrypted mSecure Cloud database | Support replies shared by customers |
| Who is affected? | Reported: users who synced through mSecure Cloud | Support replies shared by customers |
| Were vault contents read? | Reported: no evidence of that | Support replies shared by customers |
| When did it happen? | Not stated | None |
| How many users? | Not stated | None |
| What should customers do? | Change passwords, reset or re-enrol 2FA, remove passkeys | mSeven email, 3 November |
The gap between the two columns is why customers are angry. One told The Register: "I have over 800 passwords in mSecure, is the email saying I need to change all of them!" Another, with more than 500 stored, asked whether every passkey and 2FA method was meant, or only those protecting mSecure itself. mSeven has not answered that publicly either.
How mSecure encrypts your vault
The reason a stolen database might not be a disaster lies in how mSecure says it locks your data. Its support article "mSecure's Security Model - Secure by design" sets out the design, and it is worth reading closely because it decides how much risk you carry.
- Encryption happens on your device. "Your data is encrypted before it ever leaves your device." mSecure says it uses "AES-256-bit encryption".
- A long random key does the locking. "A randomly generated 46-character key is created locally on your device. This key is never stored on our servers." mSecure calls it the Account Key.
- Your password protects that key. "The Account Key itself is never stored on our servers. Instead, it's encrypted with your Account Password and stored only on your device."
- Staff cannot read it. A separate article says: "mSecure employees cannot access your Account Password or Account Key."
If that design holds, a copy of the mSecure Cloud database is a pile of data encrypted with keys that are not in it. To read one person's vault, an attacker would need that person's Account Key. Guessing a truly random 46-character key is not realistic; mSecure's article puts the time to brute-force one at many times the age of the universe, even at "360 billion passwords per second".
The weak point in the design
There is a catch, and mSecure's own help pages describe it. To set up a new device, you need the Account Key, so mSecure sends it to you. Its authentication article says the key arrives in an "mSecure Account QR Code" or "mSecure Authentication" email, with a PDF attachment, and that the key in it "is securely encrypted using your mSecure account password." For mSecure 6 users with iCloud Drive turned on, the article says the encrypted key is stored in iCloud Drive automatically.
So the Account Key is not only on your device. A copy sits in your email inbox, and for some users in iCloud, protected by your mSecure password. That changes the risk picture in a specific way. A stolen database alone should be unreadable. A stolen database plus access to your email, plus a weak or reused mSecure password, is a different story. That is the scenario to defend against, and it is why the steps below start with email.
mSecure's articles do not say how the Account Password is turned into an encryption key, or how many rounds of hashing slow down guessing. Those details decide how quickly a weak password falls to an offline attack, and they are not published on the pages read for this article.
How worried should you be?
It depends on how you used mSecure. Here is a rough guide built from mSecure's own design description and the reported scope. It is a way to set priorities, not a verdict on what the attacker can do.
| Your situation | Reported exposure | Priority |
|---|---|---|
| Synced through mSecure Cloud, weak or reused mSecure password | In the reported scope; password is the weak link | Highest: act today |
| Synced through mSecure Cloud, email account ever compromised | In the reported scope; encrypted key sits in your inbox | Highest: act today |
| Synced through mSecure Cloud, long unique password, secure email | In the reported scope; design should hold | High: rotate key accounts this week |
| Synced through Dropbox, iCloud or Wi-Fi only | Outside the reported scope | Moderate: follow the notice as a precaution |
| Former customer who synced through mSecure Cloud | The notice went to former customers too | High: old passwords may still be live |
mSecure's pricing page lists four sync methods: "Sync via mSecure Cloud, Dropbox, iCloud (Mac & iOS), or Wi-Fi". If you never used mSecure Cloud, the reported scope does not include you. But the scope comes from support replies, not a published statement, and mSeven's own email went to everyone. Following the advice costs time; ignoring it on the strength of a support reply is the bigger gamble.
Transparency note: CriticNest has no affiliate or commercial relationship with mSeven Software, Bitwarden, 1Password, Yubico or any other password manager or security key maker, and no link in this article earns a commission. Every quotation was read from mSecure's own pages or from published reporting of its email and support replies on 10 November 2026. No security test of mSecure was run for this article.
What to do now, in order
Changing hundreds of passwords at once is not realistic, and it is not necessary to do it in one sitting. Do it in priority order, highest damage first.
- Secure your email first. Change the password on the email address you use for mSecure and for password resets, and turn on two-factor authentication there with a method that is not stored in mSecure. Your email is where both password reset links and mSecure's encrypted Account Key live.
- Change your mSecure Account Password. Make it long and unique. This protects your vault from here on, but it does not change the passwords stored inside it, so it is a first step, not the fix.
- Rotate the accounts that reset others. Your Apple, Google or Microsoft account, your phone carrier, and any identity provider you use for work. Whoever controls these can take over the rest.
- Rotate money accounts. Banks, cards, payment apps, brokerages and any crypto exchanges or wallets. If you stored recovery phrases in mSecure, treat those wallets as the top priority and move funds to a new wallet.
- Move two-factor codes out of mSecure for important accounts. mSecure 7 can store one-time codes. If a code's secret lived in the same vault as the password, the two were never really separate. Re-enrol those accounts in a separate authenticator app or a hardware key.
- Replace passkeys stored in mSecure. Malwarebytes' advice is sensible: make sure another sign-in method works first, then remove the old passkey in each site's security settings and create a new one somewhere else.
- Work through the rest by importance. Work accounts, cloud storage, social media and shopping, then everything else. Note each one as you go.
- Decide where new passwords go. Malwarebytes suggests using a different password manager temporarily for replacement credentials while mSeven investigates. mSeven's reported position is that the app is not currently unsafe. Your call, but do not put new credentials somewhere you are unsure of.
If mSecure holds work credentials
Tell your IT team now. eSecurityPlanet's advice for companies is to identify which employees used mSecure Cloud, prioritise administrative, financial and recovery access, and keep a record of which passwords, authenticator registrations and passkeys have been replaced.
Should you keep using mSecure?
That depends on what mSeven says next. Its security design, as described on its own pages, is a sound one: encryption on the device, a long random key the company does not hold, and staff who cannot read your data. Those are the right ideas. The weaker parts are the emailed copy of the encrypted key and, above all, the silence. A password manager asks for more trust than almost any other app, and a vague notice followed by details that only surface through support replies is not how that trust is kept.
If you stay, change your mSecure password to something long and unique, consider syncing through Dropbox, iCloud or Wi-Fi rather than mSecure Cloud until the company publishes what happened, and keep two-factor codes for your most important accounts outside the vault.
If you leave, judge the replacement on how it handles exactly this situation. Does it publish independent security audits? Does it publish a full incident report when something goes wrong? Does it add a second secret on top of your password, as mSecure's Account Key and 1Password's Secret Key do? Our comparison of whether Bitwarden is as secure as 1Password looks at two of the most common choices, and our explainer on how 1Password stores passwords in the cloud walks through what a cloud password manager can and cannot see.
| mSecure plan | Price shown | About per year | Includes passkeys and 2FA codes |
|---|---|---|---|
| Free | $0/mo, 30-day Premium trial | Free | Not listed on the Free card |
| Essentials | $1.66/mo paid annually | $19.92 | Yes |
| Premium | $2.49/mo paid annually | $29.88 | Yes |
Those are the prices on mSecure's pricing page on 10 November 2026. The yearly figures multiply the monthly rate by 12; the page did not show the annual charge itself. If you are within a paid year, check whether mSeven offers anything for the disruption before you cancel. It has not announced any compensation.
Should passkeys and 2FA codes live in a password manager?
This incident is a good moment to rethink it. mSecure 7 added "passwordless sign-in and built-in two-factor codes" to make accounts easier to protect, and many password managers now do the same. It is convenient: one app fills the password and the code. But it also means one vault holds both factors. If the vault is ever opened, the second factor offers no extra protection, which is exactly why mSeven's advice reaches 2FA and passkeys, not just passwords.
A reasonable middle path is to keep everyday accounts in the password manager and move the handful that matter most, such as email, bank and Apple or Google account, to a separate authenticator app or a hardware security key. Our guide to which YubiKey to buy covers the hardware option. A physical key cannot be copied out of a stolen database at all.
What earlier password manager breaches teach
mSecure is not the first password manager to lose an encrypted database. BleepingComputer recalls the 2022 LastPass breach, in which attackers stole backups containing encrypted password vaults. Researchers later linked it to cryptocurrency thefts in which attackers are believed to have cracked weak master passwords to reach stored keys and recovery phrases.
Two lessons carry over. First, the encrypted vault is only as strong as the weakest secret protecting it, and that is usually the human-chosen password. mSecure's Account Key is meant to remove that weakness, which is a real difference, but the emailed copy encrypted with your password brings part of it back. Second, attacks on stolen vaults can come months or years later, offline, at the attacker's own pace. Changing the passwords inside the vault, not just the vault's own password, is what takes that time advantage away.
Breaches at web hosts follow a similar pattern. Our guide to whether DreamHost is safe after its File Manager breach covers a different incident in the same fortnight, where stolen FTP passwords were the problem and reused passwords were the multiplier.
Questions mSeven still needs to answer
- What exactly was the suspicious activity, and when did it start?
- Was a database copied, and what did it contain? Encrypted vaults only, or also account emails, metadata or the encrypted copies of Account Keys?
- Is the scope really limited to mSecure Cloud sync users, as support replies say?
- How is the Account Password turned into an encryption key, and how hard is that to brute-force offline?
- Does the advice to rotate passkeys and 2FA cover every account in the vault, or only some?
- What has changed so it cannot happen again?
Until those are answered in a public statement, the cautious reading of the 3 November email is the right one.
The short version
mSecure warned customers on 3 November 2026 about suspicious activity and told them to change passwords, reset 2FA and remove passkeys, without saying what happened. Support replies shared by customers say an encrypted mSecure Cloud database was stolen and that only Cloud sync users are affected, with no evidence vault contents were read; mSeven has not published that itself. Its design locks each vault with a 46-character key it says it never stores, which should make a stolen database alone very hard to read, but a copy of that key sits in your email, encrypted with your mSecure password. Start with your email, then the accounts that reset others, then money. Move key 2FA codes and passkeys out of the vault, and decide on staying once mSeven publishes a full account.
Frequently asked questions
Is mSecure safe to use right now?
mSeven Software has not published enough to say. Its 3 November 2026 email reported suspicious activity and asked customers to change passwords, reset 2FA and remove passkeys. Support replies shared by customers say there is no evidence the app is currently unsafe, but that is not a published statement. Following the notice's advice is the cautious choice.
Was mSecure hacked?
mSeven's own email says only that it "recently learned of suspicious activity associated with the mSecure password management application." Support replies shared by customers and reported by BleepingComputer say a hacker stole an encrypted database from mSecure Cloud. The company has not confirmed that in a public statement as of 10 November 2026.
Can hackers read my mSecure vault?
mSecure says vaults are encrypted on your device with AES-256 and a random 46-character Account Key that is never stored on its servers, so a stolen database alone should be very hard to read. The risk rises if your mSecure password is weak and someone can also reach your email, where an encrypted copy of the key is sent.
Do I need to change every password in mSecure?
mSeven recommends protecting all confidential information stored in the app. In practice, start with your email, then accounts that can reset others such as Apple, Google or Microsoft, then banks and payment apps, then work accounts, and work down from there. Changing only your mSecure password does not change the passwords inside it.
I only synced mSecure with Dropbox or iCloud. Am I affected?
Support replies shared by customers say the issue only pertains to users who synced with mSecure Cloud. mSecure also offers Dropbox, iCloud and Wi-Fi sync. But mSeven's email went to all current and former customers and has not been narrowed publicly, so changing your most important passwords is still a sensible precaution.
Why does mSecure want me to remove passkeys and reset 2FA?
Because mSecure 7 can store passkeys and two-factor codes alongside passwords. If those secrets were in a vault that may have been copied, they need replacing too. Make sure you have another way to sign in before removing a passkey, then create the replacement in a different app or on a hardware key.
I cancelled mSecure years ago. Should I worry?
mSeven sent the notice to former customers as well, and support replies say the stolen database held information about current and former users. If you synced through mSecure Cloud and any of those old passwords are still in use, change them, starting with email and banking.
What is the mSecure Account Key?
A random 46-character key that mSecure says it creates on your device and uses to encrypt your data. mSecure says the key is never stored on its servers; it is encrypted with your Account Password, stored on your device, and sent to you in an authentication email with a QR code and PDF so you can set up new devices.
Should I switch to another password manager?
That is reasonable while mSeven investigates, and Malwarebytes suggests a different manager for replacement credentials in the meantime. Choose one that publishes independent security audits and full incident reports. Switching does not undo any exposure, so rotate your important passwords either way.
How much does mSecure cost?
mSecure's pricing page on 10 November 2026 lists a Free plan with a 30-day Premium trial, Essentials at $1.66 a month paid annually and Premium at $2.49 a month paid annually. mSeven has not announced any refund or compensation linked to the security incident.
