mSecure asks current and former users to replace stored credentials after suspicious activity
mSecure notified current and former customers to protect stored passwords, two-factor methods and passkeys after suspicious activity. Two outlets inspected the notice. Customers also relay a support reply describing theft of an encrypted cloud database; plaintext exposure, affected count and cause remain unconfirmed.
- Disclosed
- Nov 3, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Current and former mSecure users; the narrower mSecure Cloud scope is a customer-relayed support claim
- mSecure · password manager · credentials
- In the wild
- Unknown
- Notification verified by two outlets; encrypted-database theft remains customer-relayed.
What happened
The November 3 notification is established by two outlets that separately inspected it. It warns current and former customers to protect confidential information stored in mSecure while mSeven investigates suspicious activity. L3 reflects actionable credential guidance for a password manager; a mass plaintext leak is not established.
An encrypted cloud-database theft and cloud-sync-only scope appear in customer transcriptions of support replies. These remain attributed claims. No authenticated public incident statement, affected count, fixed application version, attack mechanism or proof of decrypted vault contents was located. Do not assume other sync modes are cleared. The two media inspections corroborate the warning, not independent forensic findings about theft.
Crime-scene timeline
Nov 3, 2026
mSeven sends a precautionary credential warning
The Register independently reports reading the customer email that day. It describes suspicious activity, mitigation and an investigation assisted by outside cybersecurity experts.
Nov 4, 2026
Second outlet inspects notice and reports customer-relayed scope
BleepingComputer also received the notification and follows public customer posts describing an encrypted mSecure Cloud database copy. Those posts do not establish decrypted secrets or a final affected-user count.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- The Register independently inspected November 3 emailReports seeing the original customer notice; suspicious activity and precautionary credential guidance, with no disclosed cause or confirmed secret exposure.
- BleepingComputer independently received customer notificationSeparately inspected notice; traces encrypted-cloud-database claims to customer-shared support replies rather than independent forensic confirmation.
- Customer posts claimed support response on mSecure forumCustomer Caitlin transcribes a reply alleging an encrypted copy involving current/former cloud-sync users, with no evidence of decrypted contents. The post is not authored by authenticated vendor staff.