mSecure Tells Users to Reset Credentials

A short email landed in the inboxes of current and former mSecure customers on November 3, carrying advice rather than explanation. Change your passwords, the message suggested. Reset two-factor authentication. Remove your passkeys. What prompted any of it, the note did not say.

The message went out in the name of developer mSeven Software, and it says the company recently learned of suspicious activity connected to the app. It does not describe the activity, name the systems involved, or state whether anything customers had stored was exposed.

A Warning Without a Cause

The email reached both current and former mSecure users, according to its own text, which a recipient reproduced in a thread on mSecure's support forum the same day it was sent.

What the company did say is that it opened an investigation, moved to limit the problem, and brought in outside cybersecurity experts. Those are the only concrete actions described. The email gives no timeline for the activity, no indication of whether it has been stopped, and no figure for how many people received the notice.

As of 18:00 UTC on November 3, mSeven had posted nothing about the email on mSecure's X and Facebook accounts, and no staff member had responded in the forum thread where the customer posted it.

The Steps Are Offered, Not Ordered

The advice itself is framed as a set of possibilities rather than a firm instruction. The email does not specify which accounts a customer should deal with first, nor does it explain how to carry out each step.

It also leaves open a more basic question: whether customers should keep using mSecure at all, including for storing whatever new passwords they set. Nothing in the message addresses that point, based on the text shared in the forum thread.

Readers are told to change passwords, reset 2FA and remove passkeys. What the email does not clarify is whether the 2FA and passkey instructions apply to items stored inside the vault, to the mSecure account's own sign-in, or to both.

Which Sync Path, and Does It Matter

mSecure can synchronize a customer's vault through mSecure Cloud, Dropbox, iCloud or over Wi-Fi. The email does not say whether the choice of sync method has any bearing on a customer's exposure, and it offers no separate guidance for one route over another.

That silence leaves customers who use mSecure across several devices with no way to tell, from the notice alone, whether their particular setup falls inside or outside the problem the company is investigating.

Passkeys and Codes Live in the Vault Too

The instruction to reset passkeys and 2FA carries more weight for users on newer versions of the product. mSecure 7 can keep passkeys and 2FA codes in the vault alongside passwords, a feature available on its Essentials plan and above.

That means the things customers are being told to reset may themselves be stored inside the app that prompted the warning. The email does not address that overlap, and it does not say whether the activity it is investigating reached vault data or the keys that protect it.

For users who have consolidated their sign-in credentials into mSecure, the practical question of how to reset a passkey held in the very app under scrutiny goes unanswered in the message.

The Encryption Claim, and One Tested Version

mSecure's stated security model is that vault data is encrypted on the customer's device before it is synced, and that even the company's own developers cannot access customer information.

One data point complicates that picture for older software. In mSecure 6.1.5 for Android, mSeven could in theory access stored data, according to Germany's Federal Office for Information Security, which reported the finding in a study published in December 2025.

The BSI tested only that version, and its results may have changed with later updates. The company's November 3 email does not reference the study, the Android release, or any specific version of the app.

What the App Store Shows

As of 18:00 UTC on November 3, the newest iPhone version of mSecure available in Apple's App Store was 7.1.0, released on October 23.

The email does not direct customers to update their software, and it does not tie the suspicious activity to any particular release, platform, or build. Users looking for a version number to act on will not find one in the message.

Questions the Notice Leaves Open

Set out plainly, the gaps in the email are these:

• What the suspicious activity consisted of, and when it occurred
• Whether it has been contained
• Whether any customer data was exposed, including vault contents or the keys protecting them
• How many people received the notice
• Which sync method, if any, affects a customer's exposure
• Whether the 2FA and passkey steps cover stored items, the account sign-in, or both
• Whether customers should continue storing new passwords in mSecure

Each of those points is absent from the text as posted to the support forum, and none had been addressed in a public company statement as of 18:00 UTC on November 3.

What Customers Can Act On

Stripped to what the email actually says, the guidance is a rotation exercise. Customers are pointed toward changing passwords, resetting two-factor authentication and removing passkeys — the credentials associated with accounts they hold.

The notice does not rank those steps, explain how to complete them for each service, or indicate whether the order matters. It also does not tell recipients how to verify whether their own accounts or stored data were affected by the activity under investigation.

For former customers who received the message, the advice raises an additional question the email does not resolve: what data mSeven still holds for accounts that are no longer active, and whether the same steps apply to them.

Why It Matters

The value of an incident notice rests on what it lets a recipient do differently. This one asks people to rotate credentials without telling them what triggered the request, which leaves customers guessing at the scope of their own exposure — whether it extends to vault contents, to the account itself, or to neither. For anyone whose mSecure vault holds passkeys and 2FA codes, the instruction to reset those items may be the hardest to carry out, since the app being questioned is also where the credentials live. Until mSeven publishes specifics or answers the forum thread, customers are left to decide for themselves how far to take a warning that describes an investigation but not its subject. Readers who received the email and want to know more may find updates in the support thread or on the company's social accounts, neither of which carried a statement as of 18:00 UTC on November 3.