A Password Manager Lost an Encrypted Vault Database and Is Telling Users to Reset Everything. If Your Staff Used It, What Do You Do in the Next 24 Hours?

mSeven Software notified current and former mSecure password manager customers on 3 November 2026 that it had found "suspicious activity" involving the app, and support replies reportedly say an attacker stole an encrypted database from mSecure Cloud. According to BleepingComputer, the notice does not say which systems were affected, whether customer data was taken, or how many users are involved. mSeven has not publicly explained how the breach happened, and BleepingComputer had no reply to its questions when it published.

What is known

Per the same report:

• Customers say support told them a hacker stole an encrypted database from mSecure Cloud holding information on current and former users.
• The company reportedly has no evidence the attacker accessed the confidential information inside that encrypted database.
• Support says the issue affects only users who synced with mSecure Cloud, that extra security measures have been added, and that there is no evidence the app is currently unsafe.
• mSecure describes its vaults as AES-256 encrypted with a zero-knowledge design, meaning data is encrypted on the device before upload and the company says it cannot read decrypted contents.
• Users are advised to change the passwords stored in the manager, reset or re-enroll two-factor authentication, and remove existing passkeys.

What is not known

There is no count of affected users, no size for the database, no named attacker, and no account of the intrusion route. Those are the facts that decide how worried a given organisation should be, so treat any confident claim about impact, including the vendor's, as provisional until mSeven publishes detail.

Why "it's encrypted" is not the end of the question

A stolen encrypted vault cannot be read directly, but it can be attacked offline. The attacker can guess master passwords at their own pace with no rate limiting and no lockout, and only the strength of the master password and the key-derivation settings stand in the way. BleepingComputer draws the comparison to the 2022 LastPass breach, where stolen encrypted vault backups were later linked to cryptocurrency thefts. The practical consequence is a split: users with long, unique master passwords are in a far better position than users with short or reused ones, and an organisation usually cannot tell which staff fall into which group.

The risk also extends to what vaults hold. mSecure says it stores passwords, passkeys, financial information and other sensitive data, so a successful crack would not be limited to one login.

What to do this week

1. Find out who used it. Ask staff, and check expense claims and browser extensions, for mSecure use. Personal password managers on work devices are common and rarely inventoried.
2. Rotate by value, not alphabetically. Start with identity provider and admin accounts, cloud consoles, source code hosts, email and anything with payment authority, then work down.
3. Re-enroll second factors and remove passkeys held in the affected vault, as the vendor advises. Treat any TOTP seed stored alongside a password as exposed together with it.
4. Change the master password for anyone who keeps using the product, and make it long and unique. Do not wait for the vendor's investigation to finish.
5. Watch for use of old credentials. Rotation closes the door; monitoring tells you whether someone already tried it. Look for logins from new locations, impossible travel, repeated failures followed by a success, and new MFA devices or API tokens on accounts that were in the vault.
6. Set a review date. Offline cracking can succeed months later. Revisit the list of at-risk accounts at 30 and 90 days.

How Obiguard SOC fits

The hard part of a vault theft is the window after it: you may not know whether credentials were cracked, and an attacker who uses a valid password looks, at first glance, like the user. Obiguard SOC is our security operations service, and this is the kind of case it is built for. Analysts watch authentication and identity telemetry for the signals in step 5 above, such as logins from unfamiliar places, successful logins after bursts of failures, and newly registered MFA devices, and escalate them while there is still time to cut off a session. During a reset campaign it also gives you a second pair of eyes on whether rotated accounts are still being probed with the old credentials. SOC monitoring does not stop a vendor being breached and does not tell you which of your staff used a given product; it shortens the time between an attacker using a stolen credential and someone noticing.

Our earlier piece on machine-speed intrusions covers why that detection window keeps shrinking.

The question to take away

If every credential in one employee's password manager were in an attacker's hands tonight, which of your systems would show it by tomorrow morning? If the answer depends on the user reporting it, there is a monitoring gap to close.

Sources

• BleepingComputer: mSecure password manager hack prompts password reset warnings