On November 3, mSecure’s developer, mSeven Software, told customers to change passwords, reset two-factor authentication (2FA), and potentially remove passkeys after detecting suspicious activity tied to its password manager.
mSeven said it had opened an investigation but did not explain what triggered it or whether anyone’s stored secrets were exposed. Because the advice covers several ways to authenticate, customers cannot tell from the notice whether changing account credentials contains the risk or whether vault contents may also be involved.
If your organization relies on mSecure, that missing scope leaves responders unable to determine whether the concern is limited to account access or extends to credentials and other secrets stored in users’ vaults.