mSecure warns customers to rotate credentials following cloud database theft

Password manager maker mSeven Software sent notices to customers on November 3, 2026, disclosing that an unauthorized actor obtained an encrypted copy of a database holding information from current and former mSecure users. The company said it detected suspicious activity, brought in outside cybersecurity experts, and urged users to immediately update their master passwords, change vital stored passwords, reset two-factor authentication, and replace passkeys. [2][3]

mSeven emphasized that the issue only affects users who synced credentials using mSecure Cloud, adding that it has seen no evidence that attackers have decrypted the stolen records or accessed confidential information inside the cloud vault. The firm also stated that deleting the application will not resolve the situation and maintained that mSecure remains safe to use. [2]

The incident drew fierce backlash on Reddit and company support forums, where customers complained about vague initial notifications that left them facing hours of work resetting hundreds of stored credentials. The breach follows similar cloud security troubles across the sector, including recent data loss incidents confirmed by competitors LastPass and Dashlane. [2][3]