mSecure Says Its Password Database Was Copied. Here Is Your Checklist

If you keep your passwords in mSecure, this week's email from its developer deserves an evening of your time. On 3 November mSeven Software told current and former customers it had "recently learned of suspicious activity" tied to the password manager, had investigated, taken mitigation steps and called in outside cybersecurity experts, Malwarebytes and TechRadar reported.

What we know, and what we don't

A follow-up notice, quoted by TechRadar, said "an unauthorized actor acquired an encrypted copy of a database" holding data from current and former users. The company says it has "no evidence" the attacker accessed the confidential information inside, that the issue affects only people who synced with mSecure Cloud, and that deleting the app would not help.

What is missing: how the attacker got in, when, how many users are affected and whether the encrypted data could ever be cracked. Malwarebytes noted the original notice did not say whether stored data was accessed, and some Reddit users called it "wildly insufficient", according to TechRadar.

The order of operations

The company's notice and Malwarebytes' guidance point to the same checklist. Work through it in this order:

• Change the mSecure master password first, as mSeven recommends.
• Rotate the passwords that unlock everything else: primary email, banking, work and any account used to recover other accounts.
• Change each password on the service's official website or app, never through a link in an email; breach news attracts phishing.
• Re-enroll the two-factor authentication codes stored in the vault.
• For passkeys kept in mSecure, create a new one elsewhere and remove the old registration, but only after confirming another way to sign in works.
• Consider saving new credentials in a different manager until the facts are clear, as Malwarebytes suggests.

A stolen encrypted database is a clock, not a catastrophe. Your job is to make every secret in it stale before the clock runs out.

The family angle

If you set up mSecure for a partner, parent or teenager, their vault may have been synced too. Sit down together, start with email and banking, and give it the hours it needs; some users store hundreds of logins. Then make one rule permanent: a long, unique master password used nowhere else, and two-factor authentication on the email account that can reset everything. If you think an account has already been misused, contact the provider and your bank directly.