mSecure password manager incident: how to tell if your vault was hit
Quick answer
mSecure’s maker, mSeven, emailed users on Nov 3 that an unauthorized person got an encrypted copy of a database covering current and former users (mSecure support notice). mSeven says it has no evidence the information inside was accessed. It only matters if you sync with mSecure Cloud. If you do, change your master password today, then your most important passwords.
Who’s affected
- mSecure Cloud sync users, current and former. mSeven says the issue “only pertains” to people who synced through mSecure Cloud (mSecure).
- Likely not in scope: since mSeven ties it to mSecure Cloud only, people who sync only with Dropbox, iCloud or Wi-Fi sync, or never synced, aren’t covered by this notice.
- Deleted the app? mSeven says deleting it doesn’t change anything. If your vault was ever in mSecure Cloud, follow the steps below anyway.
Why “encrypted” still matters
- mSecure encrypts your vault on your device (AES-256) before it syncs, so the copy is scrambled without your master password.
- The risk is offline guessing: whoever holds the copy can try passwords against it as long as they like. A short or reused master password is the weak spot. A long, unique one buys you time.
How to check
- Open mSecure → Settings → Sync. If it says mSecure Cloud (now or in the past), you’re in scope.
- Check your inbox for mSeven’s Nov 3 email. Read it in the app or on support.msecure.com, not through links in follow-up emails.
What to do if you’re in scope
- Change your master password to a long, unique passphrase you’ve never used anywhere else.
- Change your vital passwords first: email, bank, and any account that can reset others.
- Reset two-factor codes stored in mSecure (set up the authenticator again on each site).
- Replace passkeys stored in the vault for important accounts.
- Watch for phishing. Scammers love breach follow-ups. mSeven won’t need your master password.
FAQ
- Were my passwords stolen? An encrypted copy was taken. mSeven says it has no evidence anyone opened it. Changing passwords is a precaution.
- Should I switch password managers? That’s your call. Do the steps above first either way, since they protect you no matter what you use next.
- I only use iCloud or Dropbox sync. Do I need to do anything? mSeven ties the incident to mSecure Cloud only. A master password change is still cheap insurance.