Rupert Marais joins us to break down the recent security alert surrounding mSecure, a situation that has left many users questioning the safety of their digital vaults. As a specialist in endpoint security and network management, Rupert provides a critical look at how vague disclosures can complicate incident response for everyday users. We explore the implications of the suspicious activity reported by mSeven Software, the potential vulnerabilities uncovered in recent technical studies, and the high-stakes process of resetting passkeys and two-factor authentication in a landscape of uncertainty.
When a security provider reports “suspicious activity” without clarifying whether the breach impacted cloud-synced data or local vaults, how should a user prioritize their response across different platforms like Dropbox or iCloud?
The lack of clarity in the November 3rd email from mSeven Software is particularly troubling because it leaves users guessing which sync channel might be compromised. Since mSecure allows for vault synchronization through several avenues—including their own mSecure Cloud, Dropbox, iCloud, and even local Wi-Fi—the failure to pinpoint the source of the activity means a user must assume every point of entry is at risk. If you are one of the many who received this warning, you shouldn’t wait for the company to update their social media accounts, which notably remained silent even as of 18:00 UTC on the day of the announcement. Your immediate action should be to secure the “source” accounts, specifically focusing on your primary email and cloud storage providers, before even touching the password manager itself. It is a nerve-wracking experience to have to audit every single digital connection when the developer hasn’t even confirmed if the activity has actually stopped.
Late last year, in December 2025, a study by Germany’s Federal Office for Information Security revealed that developers could theoretically access data in certain Android versions of the app. How does this finding change our understanding of the “zero-knowledge” encryption users expect?
That study by the BSI was a watershed moment because it targeted version 6.1.5 for Android and found that the supposed “impenetrable” wall between the developer and the customer’s data wasn’t as solid as advertised. When a technical audit suggests that a company could, in theory, access stored data, it creates a lingering sense of dread that persists even through newer updates like the 7.1.0 iPhone version released on October 23. Even though mSecure maintains that vault data is encrypted locally before it ever touches a server, the BSI findings suggest that architectural flaws can bypass these promises. For a user in 2026, this means that “zero-knowledge” should be treated as a goal rather than a guaranteed fact. You have to look at the track record of the company’s transparency, and right now, the silence on their support forums and Facebook pages is not inspiring the level of confidence needed to trust their encryption claims.
The developer’s advice included resetting two-factor authentication codes and removing passkeys, which is an incredibly labor-intensive task. What makes this specific step so critical compared to a simple password change?
This is where the situation becomes truly dire for users on the Essentials plan or higher, because mSecure 7 allows you to store your 2FA codes and passkeys right alongside your passwords. If an attacker managed to reach the vault or the keys protecting it, they wouldn’t just have your login credentials; they would have the “keys to the kingdom” that bypass secondary security measures. Resetting these is a grueling, manual process that requires logging into every single individual account to de-register and re-register new security tokens. The email from mSeven didn’t even specify whether users should continue using mSecure to store these new, updated passwords, which is a massive oversight in guidance. This creates a circular security dilemma where you are essentially asked to trust a potentially compromised vault with the very secrets you are creating to replace the old ones.
Do you have any advice for our readers?
My advice is to immediately move your two-factor authentication seeds and passkeys out of your primary password manager and into a dedicated, hardware-based security key or a separate authenticator app. This incident proves that “convenience” is often the enemy of “security”; when you consolidate every single layer of protection into one digital file, you create a single point of failure that can be catastrophic if “suspicious activity” occurs. Don’t wait for mSeven to provide a detailed post-mortem or a formal apology in their support threads. Take ownership of your digital identity today by diversifying where your secrets are stored, ensuring that even if one vault is compromised, your secondary authentication remains out of reach for any intruder.
