mSeven Software, the company behind the mSecure password manager, is telling current and former customers to change their passwords, reset two-factor authentication and remove passkeys. BleepingComputer reports that the warning follows a cyberattack in which a hacker reportedly stole an encrypted customer database.
If you use mSecure and sync through mSecure Cloud, this one applies to you. The steps are extensive, and the notices so far give little detail about what happened.
We couldn't check mSeven's emails or support replies directly. The reporting below comes from BleepingComputer and TechRadar, and each claim is attributed to the outlet that carries it.
What mSeven has said
The first notice went to customers on November 3, according to both outlets. BleepingComputer, which says the notification was shared with it, quotes the company as saying it "recently learned of suspicious activity associated with the mSecure password management application". It says mSeven launched an investigation, took steps to mitigate the issue and hired outside cybersecurity experts.
That notice asked customers to protect what they keep in the app, and the wording was broad: "This may include changing passwords, resetting or re-enrolling two factor authentication methods, or removing existing passkeys." BleepingComputer says it didn't explain which systems were compromised, whether customer data was stolen or how many users were affected.
More detail followed. TechRadar reports a follow-up notice that it says mSecure allegedly sent and that was shared on social media, saying an "unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users". The same notice, as quoted by TechRadar, says mSeven "has no evidence" that the actor accessed the confidential information stored in the database.
BleepingComputer reports similar support replies posted by customers, including one saying that "this issue only pertains to users that were synching with the mSecure Cloud." TechRadar adds that the company said deleting the app won't help, and that it has no evidence mSecure is unsafe to use today.
Why encryption doesn't end the worry
BleepingComputer says mSeven's documentation describes AES-256 encryption and a zero-knowledge design, where data is encrypted on the device before it's uploaded and the company can't read decrypted vaults. That has left some customers confused about why they should change everything at all.
The answer is that a stolen vault can be attacked offline. BleepingComputer warns that attackers can try to crack weak master passwords that way, and points to the 2022 LastPass breach, where researchers later linked cryptocurrency thefts to stolen encrypted vaults. TechRadar makes a related point about attackers who hoard encrypted data in case it can be broken later.
A strong, unique master password is a much better position to be in than a short or reused one. It isn't a reason to skip the reset.
What to do now
According to TechRadar, mSeven recommends that customers change their master password, change vital stored passwords, reset two-factor authentication methods and replace passkeys, which it calls "a standard best practice". For anyone with hundreds of logins, that's hours of work, and TechRadar reports that some customers are unhappy about being asked to do it with so little explanation.
There's no confirmed next step yet. BleepingComputer says mSeven hasn't publicly explained how the breach happened and hadn't answered its questions when it published. How many people are affected is also still unknown.
Mia's take: Don't try to do all of it in one sitting. I'd start with the master password, then whatever could unlock everything else: your email, your bank and any account that holds payment details. Work down from there. I also think mSeven owes customers a clear account of what was taken, because "change everything" is a big ask without one.
Reporting notes
