This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

I find it interesting that the email doesn't specify which application (which platform) had suspicious activity.  I use both iOS and microsoft store versions of the app. 

I just received an email from mSeven following my tickt from yesterday. see the following important part of the mail:

".... 

Thanks, @Klaus!

Thanks for letting us know, Klaus. Good news, if true, for those using Sync methods other than mSecure Cloud. 

Your architecture ensures that the data can only be deciphered locally. What aspect of the incident then justifies your recommendation to replace all credentials, including two-factor authentication methods and passkeys?

On the face of it this is good news - we have always been told that the mSecure Cloud is securely encrypted and the master access keys are not stored on their server.

However this has been a public relations disaster for mSeven - they should have flooded the Internet (and especially this forum) with as much information as possible rather than letting us all imagine the worst.

Over the years I've been a big supporter of mSecure but now might be the time to move on.

@Olivier,

Candidly, it's because they really don't know how bad it is, or how many customers it's impacted. I had a go at them about three years ago because I noticed that the default installation turned on some of the remote backup/syncing options by default. I said that this was insecure by design, and was firmly told that I was being paranoid.

It gives me no pleasure to see mSeven in the (terminal?) mess that they now find themselves because of their hubris, but they were making decisions that favoured revenue, and to be fair to them perhaps convenience, over security, and it makes me doubt just how isolated and robust their claim is that everything truly is encrypted at rest and only decipherable on a client. Their radio silence on this for 24 hours leads me to question whether it is safe to assume much about their architecture.

Like many, I guess, I've been spending a lot of time changing passwords - and migrating away from mSecure in the process. Like many, I've been doing a lot of work on devices in airplane mode, so that mSecure couldn't communicate with the world, just in case they truly had shipped compromised code.

I probably didn't need to, but frankly, I just don't trust mSecure anymore.

Reading between the lines, they don't appear to trust themselves, or their architecture, either.

@Oil: I don’t trust mSecure anymore either!

I simply shared the information I received with the community.

Unfortunately, there hasn’t been an official statement from mSecure—neither here in the forum nor on their website—and that is a communication disaster!

I cannot trust a company that acts this way; I’ve deleted mSecure from all my devices, wiped all the data, and canceled my subscription. I’ve already updated my most important accounts, and the rest will follow—it’s a massive undertaking!

But what are the alternatives? mSecure was convenient, and I used it extensively for years. Sadly, convenience often comes at the expense of security, and finding a reliable alternative app or company that you can actually trust is no easy task...

get your finger out MANAGEMENT TEAM. .. we need to know if our data stored in your software has been compromised.. NOW PLEASE 

Goodbye msecure, you have been the worst security software mistake I have ever made. 

I guess you only know how bad companies are when they find themselves in situations like this and think that a response like Ben received makes it alright.

You've just proved that anything in the cloud is unsafe and should never be used to store important info

I bet all the alternatives are shaking their heads is disbelief at you