mSecure tells current and former customers to change passwords after breach

mSeven Software sent mSecure customers a security notice on November 3 telling them to change passwords, reset or re-enrol two-factor authentication, and remove existing passkeys. BleepingComputer reported the notice the next day.

The notice itself is thin. It says the company "recently learned of suspicious activity" tied to the mSecure password manager, launched an investigation, took steps to mitigate it and brought in outside security experts. It doesn't say which systems were hit, whether customer data was taken, or how many people are affected.

Customers filled the gap themselves. Support replies shared on a forum say a hacker stole an encrypted database from mSecure Cloud, that it held data on current and former users, and that the issue only touches people who synced through the cloud. The same replies say mSeven has no evidence the attacker got at the confidential information inside the database.

That last point is doing a lot of work. mSecure advertises AES-256 encryption and a zero-knowledge design, with vaults encrypted on the device before upload. A stolen vault is still a target for offline guessing at weak master passwords, which is roughly what happened with LastPass backups in 2022. Customers have asked why they should rotate everything if the data was encrypted; mSeven hasn't publicly explained how the breach happened.

We'd treat the silence on scope with some suspicion, though the advice to rotate is cheap enough to follow either way. BleepingComputer says mSeven hadn't responded to its questions at the time of writing.