mSeven warns mSecure users about suspicious activity and opens research

The mSecure password manager informed current and old customers on November 3 that he has detected "suspicious activity" related to his application and recommended that users take steps to protect the data they store in their vaults. The message does not describe what happened, does not clarify whether the encrypted data were compromised and omits key operational details: it does not identify the affected systems, does not indicate when the activity occurred or how many people received the notice. The company, mSeven Software, said it had initiated an investigation, limited the problem and hired external experts, but, at 18: 00 UTC on November 3, it had not yet communicated this information publicly in its X or Facebook accounts or responded in the thread of the forum where a client published the text of the mail.

Facts confirmed: mSeven sent the notice to customers and former employees on November 3; the message recommends actions such as changing passwords, restoring the authentication of two factors (2FA) and removing passwords; mSecure offers synchronization of the vault by mSecure Cloud, Dropbox, iCloud or Wi-Fi; mSecure 7 can store passwords and 2FA codes within the vault itself in essential or higher plans; the version published in the App Store for the latest iPhone is 7.1.0 (released on October 23). In addition, a study by the Federal Information Security Office of Germany (BSI) found in December 2025 that a specific version, mSecure 6.1.5 for Android, in theory allowed mSeven to access stored data - that test was limited to that version.

What the notification means technically and why it matters: Password managers work by encryption the "vault" on the user's device with a key derived from the master password before any synchronization. If this model is respected, the service operator cannot read the data without the master password or without access to the user's cryptographic keys. However, there are two vectors that would turn the detected activity into a real risk: 1) if the intrusion reached the encryption keys or service components that can decipher or repack the vault, and 2) if the client software (the app itself) contains failures that allow the company or an attacker to extract data in flat text in certain scenarios (the problem that the BSI detected in 6.1.5 is a theoretical example of this second case). The mSeven release does not clarify whether the activity reached vault data, the keys that protect them or only affected synchronization and metadata systems.

Who it affects: any person who uses mSecure to store passwords, passwords or 2FA codes could be affected, but the level of risk varies. Users who keep passwords and 2FA codes inside the vault (function available in mSecure 7 in essential and higher plans) face greater exposure if the vault is compromised. Attention should also be paid to those who synchronize through cloud services (mSecure Cloud, Dropbox, iCloud), because the synchronization vector influences the reach of a gap. Users of old versions, in particular Android 6.1.5 that the BSI analyzed, should check their version and update if patches are available.

Possible actual consequences: if the intrusion did not reach the encryption keys or the decryption logic of the app, the specific risk of password disclosure remains low. If, on the other hand, an attacker obtained access to the keys or took advantage of a customer vulnerability that allows clear data to be extracted, then any element stored in the vault - passwords, passwords and 2FA codes - could be compromised. The lack of public details makes it impossible to know whether this is a minor infrastructure incident or access to sensitive data; therefore, the prudent policy for critical accounts (bank, mail, code repositories, domain management) must be to take potential risk until the company confirms otherwise.

What the user should do now (concrete and practical steps): first, act urgently for high-value accounts.

Recommended immediate changes: change the master password of mSecure if the application allows without losing access to the vault; if you are not sure how to do so, contact the mSeven support and follow your verified instructions on your official website. Rote (change) the passwords of your most critical services - mail, banking, domain administrators, cloud, code repositories - using a device and a connection you trust. To the extent possible, prioritize services where a take-over would have an economic or identity impact.

2FA and passwords: do not assume that keeping codes or passwords in the same vault is safe until mSeven confirms the range. For critical accounts, temporarily remove passwords or TOTP codes stored in mSecure and re-register them exclusively from the official suppliers' managers or applications (or, better yet, use physical security keys like FIDO2 / YubiKey) to restore confidence. If a service allows to revoke sessions or keys (tokens OAuth, access keys), do so and reissue new credentials.

Synchronization and versions: temporarily disable cloud synchronization (mSecure Cloud, Dropbox, iCloud) and limit use to local Wi-Fi synchronization if you need access between devices. Check the version of your app: Android users must contrast the version with BSI observations and immediately update to the latest version of the developer. Install operating system and app updates from official stores.

Support and migration: make an encrypted back-up of your vault if the app allows and consider exporting critical passwords to update and temporarily save them in another trusted manager or in a safe offline place as long as the investigation is not completed. Avoid introducing new passwords into mSecure until technical confirmation that vulnerability was closed.

Monitoring and audit: active access alerts (where the service allows), review login and active sessions, and ask your critical suppliers to revoke old sessions or reconnect devices. Keep a record (dates and actions) of changes made to be able to reverse if the situation is clarified.

Information still uncertain and signs to monitor: we do not know whether the intrusion allowed third parties to decipher vaults or whether it was only an abnormal activity in support systems. There is also no confirmation as to whether the sent notice covers the mSecure account (login to service) in addition to the data stored in the vaults. The company should publish a technical report with scope, affected vectors and mitigation; that publication is the key indicator for relaxing measures. Meanwhile, watch official releases on the mSecure site and its social channels, and look for confidence updates from agencies such as the BSI or the national cybersecurity centre in your country.

For general guidance on how to use password managers and reduce risk, see the supplier documentation and independent resources as the UK National Cyber Security Centre guide on password managers: https: / / www.ncsc.gov.uk / guidance / password-managers. The official site of mSecure where to search for warnings and support is https: / / www.msecure.com /, and for the context on software analysis and government studies, the BSI website is available: https: / / www.bsi.bund.de / EN /.

Conclusion: MSeven's alert requires caution and critical accountability. Public communication from the company and a clear technical report are decisive in defining the actual scope of the incident; until then, the prudent response is to take potential risk, rotate sensitive credentials, separate authentication elements outside the vault where possible and actively monitor any suspicious activity.