mSeven Software has told current and former mSecure customers to protect information stored in its password manager after discovering suspicious activity. Lawrence Abrams’s November 4 BleepingComputer report quotes a November 3 customer notice recommending password changes, two-factor authentication resets and removal of existing passkeys.

Evidence status: a company security notice reported by BleepingComputer, with encrypted-database theft described in customer-posted support responses. The reviewed material does not confirm that attackers decrypted vault contents or took over customers’ accounts.

The cloud-only scope is a reported support answer

The initial notice quoted by BleepingComputer does not identify the compromised systems, stolen data or number of affected users. It says mSeven began investigating, took mitigation steps and engaged outside cybersecurity experts.

Customers subsequently published more specific answers on the vendor-hosted support forum. Caitlin reproduces a response saying an unauthorized actor acquired an encrypted database containing current and former users’ information. The copied response says the issue concerns users syncing through mSecure Cloud. Thomas reports receiving the same cloud-sync qualification in another discussion.

These are customers reproducing private support correspondence, rather than a signed public technical bulletin. The response also says mSeven has no evidence that the confidential information inside the encrypted database was accessed. That limits the finding; it does not establish that the stolen copy poses no risk.

People using local storage, Wi-Fi sync or another cloud provider should seek explicit confirmation of their own exposure. The reported cloud-only answer is insufficient to certify every alternative configuration as unaffected. Former users also need to consider whether credentials once stored there remain valid.

Replace the credentials at the accounts that trust them

Changing the master password protects the current vault with a new password. It cannot change an encrypted copy already held by someone else, or rotate the passwords used by unrelated services.

The copied support response recommends changing the master password and vital stored passwords, resetting two-factor methods and replacing passkeys. A practical order for that work is:

  • Start with recovery email, financial accounts and administrator access. Change each password through that service’s known website or app, using unique replacements.
  • Review other stored authentication material. If the vault held authenticator setup secrets, recovery codes or passkeys, follow each service’s process to replace or revoke them. Deleting a vault entry alone does not revoke the credential at the service.
  • Keep a working recovery path. Confirm replacement authentication works before removing an old method, and review active sessions and recent account activity.

That ordering is precautionary account protection, not evidence those accounts were breached. Use a trusted device and storage arrangement for replacement credentials. The available disclosures do not establish a complete, independently verified safe workflow for continuing to sync new secrets through mSecure Cloud.

An encrypted copy leaves unanswered questions

The reviewed sources provide no affected application-version range, patched release, full stolen-data inventory or technical explanation of the intrusion. An app update alone therefore cannot be described as the incident’s repair.

Encryption can protect stolen data, but evaluating that protection requires details beyond the word “encrypted.” The public record here does not establish whether a particular customer’s vault can be decrypted. Forum claims that AI makes decryption inevitable are speculation.

Caveat: the detailed theft and cloud-only scope remain attributed to customer-posted support answers; BleepingComputer had received no response to its own questions when it published.