# Password manager mSecure tells users to change passwords and remove passkeys, without saying what happened

Source: https://startwithidentity.com/blog/2026-11-03-msecure-tells-users-to-change-passwords-reset-2fa-and-remove-passkeys/
Last updated: 2026-11-03
License: content by Start with Identity. Cite the source URL.

---

mSeven Software, the developer of the mSecure password manager, emailed current and former customers on November 3 saying it had learned of suspicious activity linked to the app, opened an investigation and brought in outside experts. "mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email said, adding that this "may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." The email, seen by The Register and posted by a customer on mSecure's support forum, does not say what happened, when, which systems were involved, or whether any vault data was exposed. mSecure 7 can store passkeys and two-factor codes alongside passwords, and the company says vaults are encrypted on the device before they sync.

## Why it matters

A breach notice with no scope forces the worst-case response: rotate everything in the vault. The advice reaching passkeys and two-factor methods shows the cost of keeping every factor in one place, because a vault holding both a password and its TOTP seed is no longer two factors. From the email alone, nobody can tell whether the advice is a precaution or reflects exposed data.

If you use mSecure, start with the accounts that reset others: email, your identity provider, banking and cloud consoles. Move the TOTP seeds for those to a separate authenticator, and where a service supports [passkeys](https://startwithidentity.com/glossary/passkey/) bound to your own device, use them; our [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/) shows which business apps support them. Our [password manager](https://startwithidentity.com/glossary/password-manager/) entry covers what a vault does and does not protect.

Source: [The Register](https://www.theregister.com/security/2026/11/03/password-manager-msecure-tells-users-to-change-passwords-wont-say-why/5307296)