Password manager mSecure tells users to change passwords and remove passkeys, without saying what happened
mSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwords, reset two-factor authentication and possibly remove passkeys. It has not said what happened or whether vault data was exposed.
mSeven Software, the developer of the mSecure password manager, emailed current and former customers on November 3 saying it had learned of suspicious activity linked to the app, opened an investigation and brought in outside experts. "mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email said, adding that this "may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." The email, seen by The Register and posted by a customer on mSecure's support forum, does not say what happened, when, which systems were involved, or whether any vault data was exposed. mSecure 7 can store passkeys and two-factor codes alongside passwords, and the company says vaults are encrypted on the device before they sync.
Why it matters
A breach notice with no scope forces the worst-case response: rotate everything in the vault. The advice reaching passkeys and two-factor methods shows the cost of keeping every factor in one place, because a vault holding both a password and its TOTP seed is no longer two factors. From the email alone, nobody can tell whether the advice is a precaution or reflects exposed data.
If you use mSecure, start with the accounts that reset others: email, your identity provider, banking and cloud consoles. Move the TOTP seeds for those to a separate authenticator, and where a service supports passkeys bound to your own device, use them; our MFA matrix shows which business apps support them. Our password manager entry covers what a vault does and does not protect.
Source: The Register
Related on Start with Identity
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- BlogSony's So-net says an intruder took 2.6 million member records and 54,401 email passwords
Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala rec
- BlogBank of America tells customers not to give AI agents their banking password
Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to a
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastOkta
Okta's 2023 interview series for product managers and marketers on using customer identity to build better experiences. One season, 14 episodes.
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for