2026 mSecure (mSeven Software) — an unauthorized actor acquired an encrypted copy of a database of current and former users; company says it has no evidence the vault contents were read

2026 Unknown records affected

Data compromised

Per the notice as quoted by TechRadar, the database held information on current and former users. The company says it has no evidence that the attacker accessed the confidential information inside the encrypted database. The company's security documentation says vault data is encrypted on the device with AES-256 before it leaves the device. Reports differ on whether the notice says customer data was stolen: BleepingComputer says the original notice did not say. No record count has been published.

Technical writeup

CyPro's bulletin says mSeven has not confirmed that customer vaults or accounts were compromised, and recommends treating the event as a potential credential exposure. Germany's BSI reported in December 2025 that mSecure 6.1.5 for Android could in theory expose stored data. The BSI finding is not linked to this incident in the sources reviewed.

Root cause

In a notice sent to customers on November 3, 2026, mSeven says an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of mSecure, and that it learned of this on November 2. It asked users to change stored passwords, reset two-factor authentication and reset passkeys. It says it opened an investigation, took steps to contain the problem and brought in outside cybersecurity experts. It has not said how the attacker got in or when the copy was taken.

Data compromised

Technical writeup

Root cause

References

Breaches you may like