mSecure tells customers to change their passwords, but won't say why

A password manager has one job, so an email from yours telling you to change your passwords is about as bad as news gets. Customers of mSecure, a long-running app for iPhone, Android, Mac and Windows, got exactly that on Tuesday 3 November. mSeven Software, the US developer, said it had "recently detected suspicious activity in connection with the mSecure app," had started an investigation, taken containment steps and brought in outside security experts. Its advice was to secure "all confidential information stored in mSecure" immediately.

That's close to everything the company has said. The email doesn't explain what the activity was, when it happened, whether it's over, or whether anyone got near the encrypted vaults or the keys that unlock them. Recipients posted it in mSecure's support forum, where nobody from the company had replied by Tuesday evening. mSecure markets itself as zero-knowledge, meaning only you can read your data. Germany's BSI security agency questioned that in a 2025 review, finding the maker could in theory access stored data in the Android version it tested. Heise estimates there are around 250,000 users, with more than 500,000 installs on Google Play alone.

If you use it, don't wait for the full story. Start with the accounts that would hurt most: your email first, because it resets everything else, then banking, then anything with saved cards. Change those passwords, then set up two-factor authentication again from scratch so any codes stored in the vault are useless. Passkeys kept in mSecure should be deleted at each site and created fresh. Whether to stay with mSecure is your call. Until mSeven explains what happened, it makes sense to keep the new passwords somewhere else.

Tendvane's Privacy & accounts check can help you work out which of your important accounts still depend on a password alone, a good list to tackle first.