mSecure Tells Customers to Reset Passwords and Passkeys, but Won't Say What Happened

Password manager mSecure has told customers to take urgent action to protect their stored information, but has not said what went wrong. In an email sent on November 3 and seen by The Register, US-based developer mSeven Software said it had learned of suspicious activity linked to the mSecure application. The company said it launched an investigation, took steps to mitigate the issue and engaged external cybersecurity experts.

The email recommends that customers immediately protect all confidential information held in the app. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys. However, mSeven has not said what the suspicious activity involved, when it happened, or whether attackers accessed customer information.

That lack of detail has frustrated users. For people with hundreds of saved logins, the advice could mean hours of work, and without knowing what was affected they cannot tell which credentials matter most. Customers have taken to mSecure's support forum asking for clarity. One asked the company to state what action is required and what data was compromised, while another with over 800 saved passwords asked whether every one needed changing.