Short answer
mSeven Software notified mSecure customers on 3 November 2026 that an unauthorized actor obtained an encrypted copy of a database of current and former users. The company says it has no evidence the contents were accessed and that only users syncing with mSecure Cloud are affected, but has not said how the breach happened.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | mSeven Software (mSecure) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Password manager software |
| Country | United States |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-03 |
| People or records affected | Not disclosed. mSeven says only users who synced with mSecure Cloud are affected |
What data was exposed
- An encrypted copy of a database containing information on current and former mSecure users
- mSeven says it has no evidence the attacker accessed the confidential information inside the encrypted database
What happened
mSecure is a password manager from mSeven Software. According to BleepingComputer, mSeven sent customers a notice on 3 November 2026 saying it “recently learned of suspicious activity” involving the app, launched an investigation and engaged outside experts. Responses from customer support then described the incident more specifically: an unauthorized actor obtained an encrypted copy of a database holding information on current and former mSecure users.
What mSeven says
mSeven says it has no evidence the actor accessed the confidential information inside the encrypted database. It says the issue only pertains to users who were syncing with mSecure Cloud, that it has taken steps to bolster security, and that deleting mSecure will have no effect on the situation. Its product documentation describes AES-256 encryption and a zero-knowledge design, where vaults are encrypted on the device before upload.
Several questions are unanswered. mSeven has not said how the actor got in, how many users are affected, or what exactly the database contains beyond “information.” Customers on the support forum asked whether iCloud or Wi-Fi sync is affected and whether master passwords were reached. We did not find answers to those in the sources we reviewed.
Why the master password matters
A stolen encrypted vault cannot be read without the master password, but an attacker can try guesses offline at any speed they like. A long, unique master password makes that impractical. A short or reused one does not. BleepingComputer points to the 2022 LastPass breach, where stolen encrypted vault backups were later linked to cryptocurrency thefts, as an example of why caution is warranted. That comparison is the outlet’s, and nothing here shows the same will happen with mSecure.
What to do
mSeven recommends changing the master password, changing vital stored passwords, resetting two-factor authentication and replacing passkeys. Do all of this from the app or the official site, not from an emailed link. Expect scam emails that imitate the notice, because the breach is public and the user list is large.
Read our data breach checklist, and our guides to phishing messages and account takeover.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as mSecure or mSeven that tell you to reset your master password through a link.
- Fake 'security check' calls or texts asking for your master password, one-time codes or passkeys.
- Credential-stuffing and account takeover attempts on sites where you reuse passwords stored in the vault, if the vault is ever cracked offline.
What to do if you are affected
- 01Change your mSecure master password to a long, unique passphrase, in the app and not through an emailed link.
- 02Change the passwords that matter most (email, banking, work accounts) and reset two-factor authentication on them.
- 03Replace passkeys and other sensitive items stored in the vault, as mSeven advises.
- 04Check whether you sync with mSecure Cloud. Users who never synced are not affected, according to mSeven.
- 05Ignore any message asking for your master password and contact mSecure support through its official site.
Frequently asked questions
Were my passwords stolen?
mSeven says an encrypted copy of a user database was obtained and that it has no evidence the attacker accessed the confidential information inside it. The company states mSecure uses AES-256 encryption with a zero-knowledge design. Encrypted data can still be attacked offline, so a weak master password raises the risk.
Am I affected if I do not use mSecure Cloud?
mSeven's statement says the issue only pertains to users who were syncing with mSecure Cloud. A forum reader's interpretation that non-sync users are safe is not confirmed by the thread. Whether other backups are affected has not been answered.
How did the attack happen?
mSeven has not said. BleepingComputer's requests for comment had not been answered at publication.
Why does the notice source matter?
The statement we could read was quoted by a user in mSecure's support forum, and BleepingComputer says it obtained the customer notification. We found no standalone public notice from mSeven, so details may change.
Sources
- mSecure password manager hack prompts password reset warnings, BleepingComputer, 2026-11-04
- mSeven statement quoted in customer support thread, mSecure support forum
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.