mSeven Software has warned current and former users of its mSecure password manager to update account protections after a cyberattack reportedly exposed an encrypted customer database. The company is advising users to change passwords, reset two-factor authentication, and remove passkeys.

Even where stolen data is encrypted, incidents affecting password managers deserve close attention from businesses. These tools often sit at the centre of account access, shared credentials, and administrator logins, which means a breach can trigger wider security reviews across websites, SaaS platforms, cloud services, and internal systems.

What happened

According to the reported notice, mSeven Software said a cyberattack exposed an encrypted customer database linked to its mSecure password manager service. The company warned both current and former customers to take precautionary action, including changing passwords, resetting two-factor authentication, and removing passkeys.

Based on the source information, the incident involves an encrypted database. However, encryption does not automatically remove risk, particularly if attackers obtained associated account information or if users reused passwords elsewhere. At the time of reporting, businesses should distinguish between the confirmed warning from the vendor and any assumptions about what attackers may or may not be able to decrypt or misuse.

Why it matters for European businesses

Password managers are often embedded in day-to-day business operations. SMEs, e-commerce teams, agencies, and IT departments use them to store credentials for websites, payment tools, advertising platforms, analytics accounts, cloud services, and customer support systems. If a password manager account is compromised, the impact can extend well beyond a single software vendor.

For European businesses, the practical issue is not only whether one employee used mSecure personally or professionally, but whether business credentials, shared vaults, or recovery methods were linked to the affected service. A breach involving credential infrastructure can increase the risk of:

• Unauthorised access attempts against business accounts
• Targeted phishing using knowledge of a company’s tools or contacts
• Account takeover where passwords have been reused
• Disruption if passkeys or two-factor settings need to be rebuilt across services
• Security gaps caused by delayed credential rotation or incomplete offboarding of former staff

The incident also underlines a broader supply-chain security issue: businesses may have strong internal controls, but still face exposure when a third-party security or productivity provider is attacked.

Who may be affected

The warning is most relevant to organisations where employees, contractors, or former staff used mSecure for work-related access. This may include:

• SMEs with informal password-sharing practices
• E-commerce businesses managing storefront, payment, logistics, and marketplace accounts
• Marketing teams storing credentials for ad platforms, social media, email tools, and analytics systems
• IT teams using password managers for administrator, hosting, DNS, VPN, or cloud accounts
• Digital agencies holding client access details in shared vaults

Former customers should also pay attention. Historical accounts can still create risk if old credentials were never rotated, if recovery email addresses remain active, or if passkeys and two-factor methods were left associated with services still in use.

What companies should consider

Businesses that may have used mSecure should treat the vendor warning as a trigger for a focused access review. The exact response should depend on how widely the tool was used and what systems were connected to it.

• Identify exposure: determine whether current or former employees used mSecure for company systems, client accounts, or shared team credentials.
• Rotate important passwords first: prioritise admin accounts, email, domain registrars, hosting, cloud services, payment systems, e-commerce platforms, and identity providers.
• Review two-factor authentication: where the vendor has advised resets, update MFA settings and confirm recovery methods are still controlled by the business.
• Check passkey usage: identify where passkeys linked to mSecure may have been used and remove or replace them where appropriate.
• Audit shared access: review who still has access to shared credential vaults, especially former staff, contractors, or agency users.
• Monitor for suspicious activity: watch for unusual login attempts, password reset requests, phishing emails, and changes to account settings.
• Document the response: regulated or security-conscious organisations may want to record affected systems, remediation steps, and any follow-up checks.

For companies that depend heavily on password managers, this is also a good time to review vendor risk, credential governance, and whether critical accounts are protected by stronger identity controls such as dedicated business identity platforms, hardware-backed authentication, and clear joiner-mover-leaver processes.

While the full impact of the incident may take time to emerge, the warning itself is enough for affected organisations to review credentials and authentication settings without delay.