mSecure Warns Users To Protect Passwords and Passkeys Without Explaining Why

Your email, your bank account, your work logins.

You put those passwords in a vault so you wouldn’t have to worry about them. Then the company holding that vault tells you to start changing them — without explaining what happened.

In a Nov. 3 email, developer mSeven Software urged current and former customers to protect confidential information stored in mSecure, potentially by changing passwords, resetting two-factor authentication, and removing passkeys.^[1]

At the time of writing, there's no proof anyone read those secrets. But what could someone do if they could?

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What does mSecure’s security warning mean?

In its Nov. 3 email, mSeven Software told current and former mSecure customers to protect the confidential information they’d saved in the app. Its advice was to “immediately take steps to protect all confidential information” stored in the app.

It made no mention of the affected systems or said whether anyone could read customers’ vault contents.

The developer said it had hired outside cybersecurity experts to help investigate suspicious activity. It also said it had taken steps to address the issue, without explaining what those steps were.

By Nov. 4, customers posting on mSecure’s forum said private support replies described an encrypted database and an issue limited to mSecure Cloud synchronization.

Customers using other sync methods should confirm with the company before assuming they are unaffected.

What could happen if someone could read your password vault?

If an attacker could decrypt your password vault, they could try its saved passwords to access your accounts. That scenario has not been confirmed for mSecure. But imagine opening a readable copy and finding your email login, bank password, and work credentials.

A password manager keeps those logins together for your convenience; in this scenario, the attacker has that convenience, too.

They might try your inbox first. If they get in, they could request password-reset emails for other services, including accounts whose passwords you never saved in the vault.

That access could also let them read private messages or set up forwarding rules to keep receiving copies. Google’s account-security guidance tells users to check for unfamiliar forwarding rules and changes to recovery details.

Two-factor authentication could stop a stolen password from being enough. But what if you also saved the setup secret that generates your login codes? Someone who can read that secret could generate the codes themselves, potentially giving them both pieces they need to sign in.

Which passwords should mSecure users change first?

If you’ve spotted an unfamiliar login or a transaction you didn’t make, deal with that account first.

Otherwise, start with your email. Someone who gets into your inbox could use password-reset emails to take over other accounts.

1. Secure your main inbox. Change passwords, check the recovery email and phone number, look for forwarding rules you didn’t create.
2. Change your financial account passwords. If you saved your bank, credit card, investment, or payment-app logins in mSecure, go to each provider’s official website or app and create a new, unique password. As always, report any transactions you don’t recognize.
3. Check your Apple, Google, and Microsoft accounts. Review recent sign-ins and remove unfamiliar devices. For work logins, ask your IT team what to do.
4. Go through the remaining entries. Accounts containing private documents or personal information deserve attention before an old shopping login. If you reused a password, change it everywhere you used it.

The FTC advises contacting companies through a website or phone number you know is real, rather than using links in unexpected messages.

Does changing your mSecure master password update saved passwords?

Changing your mSecure master password does not change the account passwords stored inside the vault. Your bank will keep accepting its existing password until you replace it through the bank’s website or app.

Make that change on the bank’s website or app, then update the saved entry. Typing a different password into a vault entry alone won’t change what the bank accepts.

If an attacker already has a copy of your vault, changing its master password won't erase that copy. Replacing individual account passwords would stop the old ones from working for new logins. Review active sessions as well, since a password change may not sign someone out everywhere.

Will switching password managers secure exposed credentials?

Even if you switch password managers, you need to replace those credentials through the services they access.

You may decide you want a provider that communicates more clearly when something goes wrong. When comparing alternatives, look for published security documentation, independent audit findings, and a clear account of what the service can import.

Before deleting your old vault, check that everything you need made the move. Passkeys, attachments, and authentication secrets may need different transfer steps from passwords.

Keep track of which accounts you have secured as you migrate, so an imported entry doesn’t get mistaken for a password you have already replaced.

All-In-One Online Protection Against Spam, Scams, and Identity Thieves

4.7

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On Aura Password Manager's website

2026 Editors’ Choice

Best All-In-One Password Manager

Password Manager

Aura Password Manager

PROMOTION: Save Up to 63%

• Password manager included in Aura's security bundle alongside antivirus, a VPN, and an ad blocker
• Flags weak and reused passwords directly in the browser extension, so you can spot problems without digging into a dashboard
• Comes with a 60-day money-back guarantee, one of the longest return windows provided by a password manager

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.