Your Password Manager Says ‘Change Everything’ but Won’t Say Why: A Step-by-Step Plan for mSecure Users

Imagine opening an email from the company that holds every password you own and being told to protect “all confidential information” stored with it, with no explanation of what went wrong. That is what customers of the mSecure password manager received on November 3.

As The Register reported, the developer, US-based mSeven Software, said it had learned of suspicious activity associated with the app, started an investigation, took steps to mitigate the issue and brought in outside cybersecurity experts. Its advice to customers may include changing passwords, resetting or re-enrolling two-factor authentication, or removing existing passkeys. The company has not said what the activity was, when it happened, or whether customer data was accessed, and it had not answered The Register’s questions.

Why customers are frustrated

On the company’s support forum and on Reddit, users asked what data was involved and whether the advice really meant every stored credential. One said they had more than 800 passwords saved; another, with more than 500, asked whether the warning covered every two-factor method and passkey or only those protecting mSecure itself. Without details, there is no way to know which credentials actually matter.

A step-by-step plan when the warning is vague

Whether you use mSecure or receive a similar notice from any vendor that holds secrets, this order keeps the work manageable:

Confirm the message is real. Go to the vendor’s website or support forum directly rather than clicking links in the email. Breach notices are a favorite disguise for phishing.
Secure the vault itself first. Change the master password and re-enroll the two-factor method that protects the password manager account.
Triage what is inside. Sort entries into tiers: email accounts (which can reset everything else), banking and payment, business admin consoles and cloud services, then everything else.
Rotate the top tier today. New unique passwords for email, banking and admin accounts, plus fresh two-factor enrollment where the app stored codes or recovery keys.
Review recovery options. Check the recovery email and phone number on your most important accounts and look for sign-ins or forwarding rules you did not set up.
Work through the rest over days, not hours. Lower-value accounts can follow. Delete the ones you no longer use instead of rotating them.
Watch for updates. If the vendor later says exactly what was exposed, adjust: you may be able to stop early, or you may need to go further.

What this means for your company

If employees keep business credentials in a personal or team password manager, a vendor warning like this becomes your incident too. Know which password manager your staff use, make sure shared business accounts have an owner, and keep an up-to-date list of the accounts that matter most so you can rotate them quickly. Phishing-resistant sign-in methods, such as passkeys or hardware security keys on critical accounts, and alerts for new sign-ins limit the damage when one tool in the chain has a bad day.

Want a short, prioritized list of the business accounts you would need to secure first if your password manager ever sent a warning like this? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.