The advice to reset 2FA and passkeys suggests mSeven can't rule out exposure of what's stored in vaults, but that is an inference, not something the company has said. Customers on mSecure's support forum are asking for details; as of this writing there is no public statement beyond the email.

If you use mSecure: change the master password in the app, then rotate the highest-value accounts first (email, Apple/Google account, banking and payment, domain registrar and hosting). Re-enroll 2FA anywhere mSecure stores the TOTP secret, ideally moving it to a separate authenticator, and remove and recreate passkeys stored in mSecure. Expect fake 'mSecure breach' phishing; act only through the app or sites you type in yourself.