What to Do If Your Password Manager Is Hacked: A Step-by-Step Plan

Also on CyberFence: CyberFence Breach Monitor for scheduled checks and alerts · run a free breach check on your email .

This week, mSeven Software told current and former users of its mSecure password manager to change their passwords, reset their two-factor authentication and remove existing passkeys. According to BleepingComputer, customers were told that a hacker stole an encrypted database from mSecure Cloud. The company said it had no evidence the attacker accessed the confidential information inside, but it still asked people to take action.

If you get a notice like that, it is easy to either panic or ignore it. Neither is right. Here is what a password manager breach actually means, and a step-by-step plan for what to do.

Short Answer

If your password manager says encrypted vault data was stolen, assume an attacker can try to crack it offline for as long as they like. How safe you are depends mostly on how strong your master password is. Change your master password, then change the passwords for your most important accounts, starting with email, banking and anything holding cryptocurrency. Reset two-factor authentication where your codes or recovery keys were stored in the vault.

What "Encrypted Vault Stolen" Really Means

Most password managers, including mSecure according to its documentation, use a zero-knowledge design. Your vault is encrypted on your own device with a key based on your master password before it ever reaches the company's servers. The company cannot read it, and neither can a thief who copies it, unless they can guess or crack your master password.

The catch is that a stolen vault can be attacked offline. There is no login page to slow the attacker down, and no lockout after too many wrong guesses. They can try billions of guesses with powerful computers. A long, random master password can hold up to that. A short or reused one may not.

This is not just theory. After LastPass disclosed in 2022 that hackers had copied encrypted customer vaults, researchers tied more than 150 cryptocurrency thefts worth over $35 million to victims who had stored wallet seed phrases in their vaults, according to KrebsOnSecurity. The researchers could not prove the link conclusively, but the pattern was strong enough that they urged users to move their crypto.

Why changing only the master password is not enough

Changing your master password protects your vault going forward. It does nothing for the copy the attacker already has, which is still locked with your old master password. If they crack that copy, they will see your old passwords. That is why you need to change the passwords stored inside, too.

Your Step-by-Step Plan

Step 1: Read the notice carefully

Check what was taken: encrypted vaults, account emails, billing details, website addresses or something else. In the mSecure case, the company reportedly said only users who synced through mSecure Cloud were affected. Then go to the company's website or app yourself rather than clicking links in the email. Breach notices are often followed by phishing emails that copy them.

Step 2: Change your master password

Make it long. NIST's current guidance requires passwords used as the only login factor to be at least 15 characters. A passphrase of four or five random words is easier to remember and much harder to crack than a short, complex password. Never reuse it anywhere else.

Step 3: Rank your accounts

You do not need to change 300 passwords tonight. Start with the accounts that would hurt most:

1. Email. Whoever controls your email can reset almost everything else.
2. Banking, investing, payment apps and cryptocurrency. If you stored a crypto seed phrase in the vault, move those funds to a new wallet with a new seed phrase.
3. Your phone carrier and Apple, Google or Microsoft account. These control your devices and backups.
4. Work accounts. Tell your employer's IT contact if work logins were in the vault.
5. Shopping, social media and everything else. Work through these over the following days.

Step 4: Reset two-factor authentication and recovery codes

If your vault held authenticator secrets, backup codes or security question answers, those are exposed too. Remove and re-add two-factor authentication for important accounts, generate new recovery codes and change security answers. mSeven also told customers to remove existing passkeys stored in the app and create new ones.

Step 5: Look at the notes, not just the passwords

Many people store far more than logins: Social Security numbers, passport numbers, Wi-Fi passwords, software license keys, alarm codes. Consider which of those you can change, and watch for identity theft involving the rest. Freezing your credit with the three major bureaus is free in the US and blocks most new-account fraud.

Step 6: Watch for follow-up attacks

Expect phishing emails and texts that mention the breach and ask you to "verify" your account. Turn on login alerts for email and banking, and check for sign-ins or devices you do not recognize. If an account shows activity you did not do, sign out of all sessions and change the password from a clean device.

Step 7: Decide whether to stay

A breach does not automatically mean you should switch. Look at how the company handled it: how quickly it disclosed, how clearly it explained what was taken, and what it changed. If you switch, export your vault, import it into the new manager, then delete the old account rather than just abandoning it.

Where a VPN Fits, and Where It Does Not

A VPN would not have stopped this breach. The vault was stolen from the company's cloud, not from anyone's connection. And a VPN cannot see or protect what is inside your password manager. See can a VPN see your passwords?

Where a VPN helps is the cleanup and the weeks after:

• Changing passwords on public Wi-Fi. If you reset accounts from a café, hotel or airport, a VPN encrypts your connection so others on that network cannot see or tamper with your traffic. CyberFence uses AES-256-GCM encryption.
• Follow-up phishing. CyberFence's Web Shield blocks DNS requests to domains on lists of known phishing and malware sites, which can stop some fake "verify your account" pages from loading. Brand-new phishing domains may not be on those lists yet.

If you want ongoing alerts when your email shows up in new breaches, CyberFence also offers Breach Monitor, a separate product from the VPN plan.

How to Make the Next Breach Less Painful

• Use a long, unique passphrase as your master password.
• Turn on two-factor authentication for the password manager itself.
• Keep crypto seed phrases offline, not in any cloud vault.
• Use passkeys where sites support them. They will not work on fake sites, though passkeys saved in a vault still need replacing if that vault is exposed.
• Never reuse passwords. When one site leaks, attackers try that password everywhere. Our guide to credential stuffing explains how.
• Keep your devices free of password-stealing malware, which can grab your vault after it is unlocked. See can a VPN stop infostealer malware?

The Bottom Line

A password manager breach is serious but manageable. If an encrypted vault was stolen, your master password is what stands between the attacker and everything inside. Change it, then change your most important passwords, reset two-factor authentication and move any crypto whose seed phrase was stored in the vault. Do it from a secure connection, and stay alert for the phishing that usually follows.

Want to go deeper? Read how CyberFence Breach Monitor works , the free CyberFence breach check tool , or the CyberFence password strength tool .