Password manager mSecure has been hit by a cyberattack, and its developer is telling users to assume the worst. mSeven Software is warning both current and former customers to change their passwords, reset two-factor authentication, and remove passkeys in the wake of the incident, BleepingComputer reported.

The scope of the guidance is what stands out. Advising a password change after a breach is standard practice; extending the warning to former customers and telling users to tear down 2FA enrollments and passkeys suggests the company wants anyone who has ever touched the service to rebuild their authentication from scratch.

Password managers are among the highest-value targets in security — a single successful compromise can expose the credentials guarding every other account a user holds. That asymmetry is why incidents in this category draw outsized scrutiny, and why vendors tend to issue broad, conservative guidance even while investigations are ongoing.

For mSecure users, the to-do list is clear and worth doing immediately: rotate the master password, change passwords stored in the vault starting with email and financial accounts, re-enroll two-factor authentication, and remove and recreate any passkeys tied to the service.