mSecure Breach: Reset Passwords Beyond Your Vault
Current and former mSecure customers have been urged to protect stored secrets. Start with primary email and valuable accounts: changing your vault password alone does not replace the logins saved inside it.
The short version
What you need to know
- Encrypted database theft is described in customer-shared support replies; decrypted vault contents have not been independently confirmed.
- Replace affected secrets at the services that issued them, not just inside your password manager.
- Keep a working sign-in or recovery route while replacing two-factor methods and passkeys.
What the warning establishes
BleepingComputer reports that mSeven notified current and former mSecure customers on 3 November, urging them to protect stored confidential information. The notification advised password changes and resetting or re-enrolling two-factor authentication and removing existing passkeys. It did not identify affected numbers, systems or what was stolen.
A customer-posted reply attributed to support says an unauthorised actor acquired an encrypted database copy and limits the incident to mSecure Cloud synchronisation. It says there is no evidence confidential contents were accessed. The forum thread is not an official company announcement; neither it nor the report independently confirms decrypted vaults. Do not treat that reported scope as a definitive all-clear for every other user.
Why a master-password change is not enough
Changing your master password does not retroactively re-encrypt a copy already stolen. Whether an attacker could recover anything from that copy remains unestablished here; encrypted does not mean proven readable, but it is not a reason to ignore the warning.
Deleting mSecure also cannot retrieve a stolen copy. The useful distinction is between securing the vault you use now and replacing the secrets that could remain in an older copy.
A safer order for replacing secrets
Start with your primary email, then banking, work and other valuable accounts whose details you stored. Email often controls password recovery elsewhere. Open each service's genuine app or website yourself, set a unique new password there, then update the saved vault entry. Merely editing the entry leaves the actual login unchanged.
Follow mSecure's current official guidance to change your master password. For stored two-factor secrets or passkeys, use each account provider's official replacement or recovery instructions. Where supported, enrol the replacement and verify a new login before removing the old method. Keep a working recovery route; if the service requires a different sequence, follow its documented process rather than deleting everything first.
Review account activity and active sessions where available, and contact genuine support about unfamiliar access. Never upload your vault to an unsolicited breach-checker or give a supposed support agent your master password. These are precautionary recovery steps, not evidence that your individual accounts were accessed.
A VPN cannot repair a stolen vault
A VPN protects traffic between your device and its server. It cannot recover a stolen database, replace saved credentials or stop offline password guessing against a copy. Account-by-account replacement, not a new VPN subscription, addresses this warning.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.