mSecure Says an Attacker Took an Encrypted Copy of Its Cloud Database. If You Synced, Change Your Master Password, Reset 2FA and Remove Your Passkeys.
If you use the mSecure password manager and ever synced it to mSecure Cloud, do three things today: change your master password, reset your two-factor methods, and remove your passkeys. Then change the passwords that matter most inside the vault. That is mSeven Software's own guidance, per the notice it sent customers on November 3. Deleting the app does nothing, according to the company's support reply.
What mSeven says
BleepingComputer reported on November 4 that mSeven Software warned current and former customers. We could not find the notice on mSecure's website. What we read is a support-forum thread where a staff reply says: "Yesterday, mSeven Software learned that an unauthorized actor acquired an encrypted copy of a database." The database held data of current and former users. The same reply says there is "no evidence that the unauthorized actor has accessed the confidential information stored within the database," and that the issue only pertains to users who were syncing with mSecure Cloud.
The reply is staff text relayed by customers, so we are quoting a forum, not a press release. BleepingComputer contacted mSeven and had no response when it published.
What you are asked to do
Staff advise customers to change their master password, change vital stored passwords, reset two-factor authentication methods and replace passkeys and any other sensitive information. Deleting the app will have no impact on this situation. Customers in the thread are asking whether Wi-Fi sync and iCloud backups are affected. As of the thread, there is no answer, and one customer reports that backups officially are not stored in mSecure Cloud but is not certain.
The question everyone is asking
mSecure's documentation, as BleepingComputer quotes it, says data is encrypted on your device with AES-256 before upload, in a zero-knowledge design where the company cannot read vault contents. If that is the whole story, why reset everything? BleepingComputer notes customers are confused by the same thing.
We cannot answer it, and neither can anyone outside mSeven. Here are the parts we can reason about, labeled as reasoning:
A stolen encrypted vault is attackable offline, with no rate limit and no lockout. The attacker's cost is guessing the master password, and a weak one falls. BleepingComputer cites the 2022 LastPass theft, where stolen encrypted vaults were later linked to cryptocurrency thefts.
A forum reply in an older support thread says mSecure backups are encrypted with the same password you use to unlock the app. If that is so, a strong master password matters more than the design diagram suggests. We read that from a search snippet and did not confirm it, so treat it as a lead, not a fact.
The company asks for passkey removal and 2FA resets. That implies the database holds something related to them: the credentials themselves, or metadata that identifies them. The report does not say which, and we will not guess.
What this means by master password strength
If your master password was long, random and unique, an offline attack is expensive and the reset is cheap insurance. If it was short, a word, a pattern or reused anywhere, assume it can be recovered, and then every password inside the vault is in play. In that case, rotate the high-value ones first: email, banking, cloud and identity-provider accounts. Email goes first because it resets everything else.
What is not known
How many users. When the intruder got in and how long they stayed. How they got in and how mSeven noticed. What the database contained beyond the word "information." Whether passkey or 2FA material was inside. Whether people who never synced are unaffected, which staff did not explicitly confirm. Whether the Wi-Fi and iCloud paths are involved. mSeven has published no indicators, and there is nothing to put in the feed from this story.
Limits
We read BleepingComputer's report and one support-forum thread. We did not read a notice on mSecure's own site, because we could not find one, and we have no visibility into mSeven's systems. The support-forum text is relayed by customers and staff, not verified by the company on a public page. The encryption claims are mSeven's documentation as quoted, not something we tested.
Five percent of this is wrong somewhere. It always is. A published notice with a user count and a date will change the picture.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments