Identity · Privacy
mSecure password manager tells users to change all passwords after database theft
mSecure has told users to change their passwords after an attacker stole an encrypted copy of its cloud database. The company says there is no evidence the vaults have been decrypted, but users are frustrated by the lack of detail.
Ross Grant3 min read
The short version
mSecure, a password manager, says hackers stole an encrypted copy of its user database from the cloud. If you used mSecure Cloud to sync your passwords, you should change your master password and other important passwords. The company says your data is still encrypted, but it's safest to update your credentials. Users are upset about the lack of clear information from mSecure.
What happened?
mSecure has told users to change their passwords after an attacker stole an encrypted copy of its cloud database. The company says there is no evidence the vaults have been decrypted, but users are frustrated by the lack of detail. Only users who synced with mSecure Cloud are affected. The company has not explained how the breach happened or how many users are at risk.
What was taken
mSecure, a popular password manager, has told its users to change their passwords after an attacker stole an encrypted copy of a database from its cloud service. According to BleepingComputer (opens in a new tab) and TechRadar (opens in a new tab), the stolen database contains information belonging to both current and former users who had synced their password vaults with mSecure Cloud. The company says there is no evidence that the attacker has managed to decrypt any of the confidential information stored in the database.
The database is encrypted using AES-256, a strong encryption standard, and mSecure says it uses a zero-knowledge design, meaning the company itself cannot access users' decrypted data. However, the fact that the encrypted vaults were stolen means attackers could try to crack weak master passwords offline.
The response
mSecure's parent company, mSeven Software, sent a security notice to customers on 3 November. The notice urged all current and former users to change their master password, update important stored passwords, reset two-factor authentication (2FA) methods, and replace passkeys. The advice applies only to users who synced their vaults with mSecure Cloud. Deleting the app does not remove the risk if the vault was already synced.
The company said it had launched an investigation, brought in external cybersecurity experts, and taken steps to mitigate the issue. It also said it had implemented additional security measures but did not provide details about how the breach happened or how many users were affected. mSeven stressed that there is no evidence the app is currently unsafe to use.
Who is affected
The incident affects both current and former mSecure users who used the cloud sync feature. Users who did not sync their data with mSecure Cloud are not affected, according to the company. Some customers have hundreds of passwords and other secrets stored in their vaults, making the process of changing them time-consuming and frustrating.
What you should do
If you are an mSecure user who synced your vault with the cloud, you should:
- Change your master password to something strong and unique.
- Update important passwords stored in your vault, especially for sensitive accounts.
- Reset any two-factor authentication methods and replace passkeys.
- Watch for suspicious activity on your accounts.
Customers have criticised the company for not explaining the breach in more detail and for the scale of the password reset advice. Some users reported that negative reviews and complaints were being deleted from app stores, but this has not been confirmed by mSecure.
Has this happened before?
Other password managers have faced similar incidents. LastPass reported a breach in June 2026 where encrypted vaults were stolen, and Dashlane also confirmed hackers obtained encrypted vaults. In those cases, attackers later tried to crack weak master passwords to access stored secrets.
There is no primary source from mSecure or an official agency confirming all details. The company has not said how the attacker got in or how many users are affected. It is not clear if any vaults have actually been decrypted.
Why it matters
Password managers store the keys to people's digital lives. Even if vaults are encrypted, stolen databases can be cracked if users have weak master passwords. This incident shows why strong, unique master passwords and regular updates are crucial.
Key points
- mSecure's cloud database was stolen, affecting synced users.
- The stolen data was encrypted, but weak master passwords could be at risk.
- Users are advised to change master and stored passwords, reset 2FA, and replace passkeys.
- The company has not explained how the breach happened or how many users are affected.
- Similar incidents have happened to other password managers recently.
Sources
TechRadar
Reference
BleepingComputer
Reference
