Password manager mSecure emailed customers on November 3 telling them to change their passwords, reset or re-enroll two-factor, and maybe remove existing passkeys. The reason: “suspicious activity associated with the mSecure password management application.”
That’s it. mSeven Software hasn’t said what happened, when, or whether anyone’s vault data was accessed. They say they’ve brought in outside security experts. Customers on the support forum aren’t happy, and I don’t blame them.
My take
If you tell people to rotate everything, you need to tell them why. Without details nobody knows which credentials matter most, and for some people that’s hundreds of logins.
If you use mSecure, start with the big ones: email, banking, your domain registrar, and anything that can reset other accounts. Re-enroll 2FA on those first. And this is a good reminder for all of us to keep a hardware key on our most important accounts, so a leaked password alone isn’t enough.
God Bless, and Needs Garlic!
