mSecure cyberattack: hacker stole encrypted cloud vault database

mSeven Software, the company behind the mSecure password manager, has told customers that an attacker took an encrypted copy of a database holding information on current and former mSecure users. The company's support team said in a reply that a customer posted on mSecure's own forum that it learned of the theft the day before, that the problem "only pertains to users that were synching with the mSecure Cloud" and that it has "no evidence" the attacker accessed the confidential information stored in the database. BleepingComputer reports that other customers received similar replies.

mSeven's first notice, emailed on 3 November and reproduced on its forum, spoke only of "suspicious activity associated with the mSecure password management application" and said the company had launched an investigation, taken steps to mitigate the issue and engaged external cybersecurity experts. It still asked every current and former customer to change passwords, reset two-factor authentication and remove passkeys, which left users on the forum asking whether the app itself had been compromised.

Why an encrypted copy still matters

mSecure encrypts vaults on the user's device with AES-256 before syncing, and mSeven says it cannot read them, BleepingComputer notes. A stolen copy can still be attacked offline, without rate limits, where a weak master password is the only protection. After the 2022 LastPass breach, attackers are believed to have cracked weak master passwords on stolen vault backups and used them in cryptocurrency thefts, BleepingComputer reports. In December 2025 Germany's BSI said its test of mSecure 6.1.5 for Android found that the design could in theory let mSeven access stored data, according to The Hacker News, a finding about an older version.

What users should do

The support reply recommends that customers change their master password, change vital stored passwords, reset two-factor authentication and replace passkeys and other sensitive information. It says deleting mSecure "will have no impact", so former customers whose data was synced to mSecure Cloud are in the same position as current ones. mSeven's own guidance on unauthorized access explains why: a thief who copied a vault keeps that copy, so changing the mSecure password "does not guarantee the safety of your real online accounts". It tells users to change each password through the service's own website or app, financial accounts first, so the copies in a stolen vault stop working. The same page says Wi-Fi sync keeps data only on the user's devices. mSeven has not said how the attacker got in, when the theft happened or how many users are affected.