The developer of the mSecure password manager emailed current and former customers on 3 November telling them to change the passwords stored in the app, reset or re-enrol two-factor authentication, and remove existing passkeys. The notice does not say what happened, when it happened, or whether anything in the vault was reached.
What happened
mSeven Software said it recently learned of suspicious activity associated with the mSecure application, opened an investigation, took steps to mitigate the issue and brought in external security specialists.
What is missing from the email is everything a customer needs to act sensibly: which systems were involved, whether the activity has stopped, how many people were notified, and whether encrypted vault data or the keys protecting it were exposed. The advice covers all confidential information held in the app, not just the account login.
mSecure syncs through mSecure Cloud, Dropbox, iCloud or WiFi, and version 7 can hold passkeys and one-time codes alongside passwords on its paid tiers. The notice does not distinguish between those configurations, so a user cannot tell which of their stored items are actually at risk.
Who is affected
- Anyone who has ever held an mSecure account, since the email went to former customers as well as current ones
- Users who sync a vault through mSecure Cloud, which is the configuration where the vendor holds data at all
- Teams where a technician or bookkeeper keeps client credentials, bank logins or shared service accounts in a personal password manager rather than a managed one
What to do now
If anyone in your business uses mSecure, assume the contents of that vault are exposed and rotate the credentials that matter, starting with email, banking and domain or hosting access.
- Change the most valuable credentials first: primary email, banking and payment portals, domain registrar and web hosting, then everything else in the vault
- Reset two-factor authentication for any account whose codes were generated or stored inside mSecure, and move those codes to a separate authenticator
- Delete and re-create any passkey that was stored in the vault
- Watch for follow-up phishing that quotes the mSecure notice; only act through the app or a site typed by hand
- Move business credentials into a password manager the business controls, with shared vaults and an audit trail, rather than an individual's personal subscription
What this means for South African businesses
The uncomfortable part of this story is not the incident, it is the advice. Telling users to change everything without saying what was touched pushes the entire cost and guesswork onto the customer, and a small business with a few hundred stored logins will not get through that list in one sitting.
In practice most SMEs have no idea whether a staff member keeps client passwords in a personal vault like this one, which is the real exposure: the vendor's silence matters far less than the fact that nobody has an inventory of where those credentials live.
Use this as the prompt to pull business credentials into a managed vault with shared ownership, so the next vendor notice of this kind is an administrative task rather than an emergency.
The Register reported the notice and mSeven's silence on the specifics in this article.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.