The company behind password manager mSecure has told current and former customers to protect everything stored in the app after detecting what it calls "suspicious activity." What it has not said is what happened, when, or whether anyone's stored data was touched.
In a customer email dated November 3, quoted by Malwarebytes Labs, developer mSeven Software says it "recently learned of suspicious activity associated with the mSecure password management application," launched an investigation, took steps to mitigate the issue and engaged external cybersecurity experts. It recommends customers "immediately take steps to protect all confidential information" stored in mSecure, steps that "may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."
A warning that leaves the key questions open
As Malwarebytes points out, the notice does not identify the suspicious activity, when it occurred, which systems were involved, or whether anyone accessed customers' stored information. That leaves users to decide for themselves whether to replace every credential, and whether it is safe to put the replacements back into mSecure.
The breadth of the advice is what makes it notable. A password manager vault often holds the keys to a person's email, bank and work accounts, and mSeven's guidance reaches beyond passwords to two-factor secrets and passkeys. Malwarebytes also notes that mSecure's own documentation warns someone may already have made a backup of a vault's contents, so changing the mSecure password alone may not be enough if an account was already accessed. That documentation does not establish what happened in this incident.
Rotate key accounts first, outside the vault
Until mSeven explains the scope, Malwarebytes recommends:
- Change passwords through each service's official website or app, starting with primary email, financial and work accounts, and any account used to recover others. Use a new, unique, strong password for each.
- Review two-factor authentication stored in the vault and consider re-enrolling authenticators through each service's security settings.
- For passkeys stored in mSecure, remove the old registration in each account's security settings and create a replacement with a different provider, after confirming another working sign-in method is available.
- Think about where new credentials go. The notice does not establish whether saving them in mSecure is safe, so a different password manager for freshly rotated accounts is a reasonable precaution.
- Avoid destructive account resets.
Credential stores and the sign-in methods they hold are a prized target, as attackers' interest in passkeys and cloud identities has shown. mSeven Software is a US company; see our United States profile for wider context.
For now the burden sits with users. A notice that says "protect everything" without saying why asks customers to rotate their digital lives on faith, and the company best placed to say whether that is necessary has not yet done so.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.