# mSecure password manager hack: encrypted mSecure Cloud vault database reportedly stolen, users told to change passwords · pwn.watch > mSeven Software emailed current and former mSecure password manager customers on November 3 saying it had learned of suspicious activity involving the app, had engaged outside cybersecurity experts, and urging them to protect what they store in it, which may include changing passwords, resetting or re-enrolling two-factor authentication and removing existing passkeys. The notice did not say what was compromised or how many users are affected. Support responses shared by customers say a hacker stole an encrypted database from mSecure Cloud, that only users syncing through mSecure Cloud are affected, and that there is no evidence the encrypted contents were accessed. Stolen vaults can still be cracked offline if the master password is weak, so mSecure Cloud users should change their master password and rotate the most important stored credentials, 2FA and passkeys. Page: https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026 · generated 2026-11-04T19:41:22.834Z ## Status - Severity: high · status: live · patch: partial - Product: mSecure password manager (mSecure Cloud sync) - Started: 2026-11-03 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026.json - This file: https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: Customers share support replies saying a hacker stole an encrypted mSecure Cloud database, limited to users syncing through mSecure Cloud, with no evidence its contents were accessed. (https://www.bleepingcomputer.com/news/security/msecure-password-manager-hack-prompts-password-reset-warnings/) - 2026-11-03: mSeven Software emails current and former mSecure customers about suspicious activity and advises changing passwords, resetting 2FA and removing passkeys. (https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html) ## Fix brief # Security brief: mSecure password manager hack: encrypted mSecure Cloud vault database reportedly stolen, users told to change passwords Source: https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 17:43 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is mSeven Software emailed current and former mSecure password manager customers on November 3 saying it had learned of suspicious activity involving the app, had engaged outside cybersecurity experts, and urging them to protect what they store in it, which may include changing passwords, resetting or re-enrolling two-factor authentication and removing existing passkeys. The notice did not say what was compromised or how many users are affected. Support responses shared by customers say a hacker stole an encrypted database from mSecure Cloud, that only users syncing through mSecure Cloud are affected, and that there is no evidence the encrypted contents were accessed. Stolen vaults can still be cracked offline if the master password is weak, so mSecure Cloud users should change their master password and rotate the most important stored credentials, 2FA and passkeys. Severity detail: Reported theft of an encrypted password-vault database; weak master passwords can be cracked offline - Product: mSecure password manager (mSecure Cloud sync) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Nov 4, 2026: Customers share support replies saying a hacker stole an encrypted mSecure Cloud database, limited to users syncing through mSecure Cloud, with no evidence its contents were accessed. - Nov 3, 2026: mSeven Software emails current and former mSecure customers about suspicious activity and advises changing passwords, resetting 2FA and removing passkeys. ## Write-ups & news - [mSecure password manager hack prompts password reset warnings](https://www.bleepingcomputer.com/news/security/msecure-password-manager-hack-prompts-password-reset-warnings/) - [mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity](https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html) --- Machine-readable: https://pwn.watch/i/msecure-password-manager-cloud-vault-database-theft-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.