PanicStation.org
UK USA
uk Technology & digital loss password manager changed • vault items missing • missing passwords in vault • unexpected vault edits • password vault rolled back • password manager sync problem • vault not syncing • entries disappeared after update • shared vault changed • unknown device signed in • master password may be compromised • password manager hacked • vault history revert • deleted items in password manager • suspicious account activity • lost 2fa codes in vault • password manager shows new logins • vault emptied • password manager recovery

What to do if…
a password manager shows unexpected vault changes or missing entries

Short answer

Stop making changes and secure the password-manager account first (sign out other sessions, change the master password, turn on two-step verification). Then work from a clean device to recover the vault (history/trash/restore) and capture what changed.

Do not do these things

  • Don’t start mass-editing passwords or deleting entries “to tidy up” — you can overwrite evidence and make recovery harder.
  • Don’t uninstall/reinstall the password manager or wipe your device yet — you may lose local vault data needed to restore.
  • Don’t keep logging in/out on multiple devices trying to “force sync” — that can spread a bad sync state.
  • Don’t reuse your master password anywhere else, and don’t share it (or recovery codes) with anyone.
  • Don’t click “support” links from emails/messages or sponsored results — use in-app help, or type the vendor’s address yourself.

What to do now

  1. Pause syncing changes (reduce further damage).
    Stop editing the vault. Close the app on other devices. If needed, temporarily take other devices offline so they don’t push/pull more changes while you stabilise.

  2. From one trusted device, secure the password-manager account.

    • Check the password manager’s security/devices/sessions page for unknown devices or recent logins.
    • Sign out of all other sessions (or “log out of all devices”).
    • Change the master password immediately to a new, long passphrase.
    • Turn on 2-step verification (2SV) for the password manager account (or confirm it’s still on).
    • If the service provides recovery codes, generate new ones after securing access (old ones may be exposed).

  3. Create a “do-not-touch” snapshot for later (quick record).
    Take screenshots or notes of: the date/time you noticed, what’s missing, any “vault updated” messages, device list/logins, and any alerts. This helps if you need vendor support or later reporting.

  4. Check for built-in recovery inside the password manager.
    Look for trash/archived items, item history, vault restore, previous versions, or sync conflict prompts.

    • If it’s a shared/family/work vault, check whether another member made changes and whether there’s an admin/audit trail.

  5. Secure the most common reset route: your email account.
    Secure the email account used for the password manager: change the email password, turn on 2SV, and review account sign-in activity.

  6. Check whether a device issue is driving the changes.
    Install pending OS/browser updates. If something seems off (unknown extensions/apps, repeated pop-ups, unexpected “device management” prompts), run a reputable security scan and consider getting hands-on IT help before you do broad password resets.

  7. Prioritise a small set of high-impact accounts first.
    If compromise is possible, change passwords (and enable 2SV) for:

    • your email, banking, mobile network account, main Apple/Google/Microsoft account, and anything that can reset other passwords.
      Do this from your trusted device after you’ve secured the password manager account.

  8. Get vendor support if anything doesn’t add up.
    Use the password manager’s official support and ask specifically about: unexpected vault version changes, rollback, sync conflicts, missing entries, and account access logs.

  9. If money was stolen or you were defrauded, report it through UK channels.
    Use Report Fraud (the UK service for reporting cyber crime and fraud). If you live in Scotland or it happened there, report via Police Scotland (101).

What can wait

  • You do not need to decide today whether to switch password managers.
  • You do not need to change every password immediately — focus on securing the password manager and the most sensitive accounts first.
  • You do not need to factory-reset devices unless there are strong signs of compromise and simpler steps fail.

Important reassurance

This can happen from a benign sync conflict, an accidental shared-vault edit, a device restore, or an actual account compromise — and it often looks the same at first. Taking a calm “freeze changes, secure access, then recover” approach gives you the best chance of getting data back and preventing further loss.

Scope note

These are first steps to stabilise and prevent irreversible mistakes. If you confirm an account takeover or malware, you may need deeper incident response (IT support, bank fraud team, or specialist cyber help).

Important note

This is general information, not legal, financial, or professional security advice. If you believe a crime is in progress, you’re at immediate risk, or you’ve lost money, use official reporting and your bank’s fraud channels promptly.

Additional Resources
Support us