mSecure Alerts Users to Reset Credentials After Undisclosed Suspicious Activity Detected November 3
mSecure's vague November 3 advisory leaves users without clarity on data exposure or sync vectors. Independent BSI findings on Android access contradict end-to-end encryption assertions. Pattern of delayed transparency mirrors prior password manager incidents.
The November 3 email from mSeven Software reached users via its support forum thread but received no staff replies by 18:00 UTC. It referenced an ongoing investigation with external experts yet omitted any mention of mSecure Cloud, Dropbox, iCloud, or Wi-Fi sync paths. mSecure 7 stores passkeys and 2FA tokens on paid plans. No public statement appeared on company social channels. Germany's BSI December 2025 report identified theoretical server-side vault access in mSecure 6.1.5 for Android despite client-side encryption claims. Later versions remain untested in public audits. The advisory's silence on whether the incident reached encryption keys or stored vaults creates an evidence gap between marketing statements and operational reality.
mSeven Software: No public incident timeline or affected-user count released by November 17
Sources (2)
- [1]The Hacker News(https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html)
- [2]BSI mSecure Android Analysis(https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/mSecure_2025.pdf)