Customers of the **mSecure** password manager are being urged to take immediate action to protect their confidential information, potentially by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer **mSeven Software**. It states the company recently learned of suspicious activity linked to the app but does not specify what occurred or whether any stored data was exposed.  The email was sent to current and former **mSecure** customers. A recipient posted its text in a thread on **mSecure**'s support forum on November 3. As of 18:00 UTC on November 3, **mSeven** had not posted any information about the email on **mSecure**'s X (formerly Twitter) and Facebook accounts, nor had any staff member replied in the forum thread. The email indicates that **mSeven** has launched an investigation, implemented measures to contain the problem, and engaged external cybersecurity experts. However, it does not name the affected systems, state when the activity occurred, confirm if it has ceased, or provide the number of individuals who received the email.  **mSecure** offers synchronization of a customer's vault through **mSecure Cloud**, **Dropbox**, **iCloud**, or Wi-Fi. The email does not clarify whether the chosen synchronization method impacts the risk. **mSecure 7** can store passkeys and 2FA codes directly within the vault, particularly for its Essentials plan and above. The email's advice pertains to protecting information stored within **mSecure**, but it does not specify whether the recommended 2FA and passkey actions apply to these stored items, the **mSecure** account's own sign-in, or both. **mSecure** asserts that vault data is encrypted on the customer's device before synchronization, and that even its developers cannot access customer information. However, Germany's **Federal Office for Information Security (BSI)**, in a study published in December 2025 (note: likely a typo for December 2023 or earlier), found that **mSeven** could, in theory, access stored data in **mSecure 6.1.5 for Android**. The **BSI** only tested that specific version, and results may have changed with subsequent updates. The email does not indicate whether the suspicious activity compromised vault data or the encryption keys protecting it. ### Recommended Actions for Customers The email presents its steps as possibilities and offers no guidance on which accounts to prioritize or how to execute each step. It also does not advise whether customers should continue using **mSecure**, including for storing their newly updated passwords. As of 18:00 UTC on November 3, the most recent iPhone version of **mSecure** available in Apple's App Store was 7.1.0, released on October 23.