This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

@Corrado 

From some rudimentary digging in the web  if you want your Mac and iPhone to synchronise automatically whenever they're on the same home Wi-Fi, KeePassium isn't quite as straightforward as you might hope. That info might be out of date as I don't use it, 

How have you found Keepassium local auto sync on yr local network across devices?

The syncing across devices via a cloud service is exactly what went wrong with msecure. THAT is the weak spot and they never should have started to offer this. Especially not towards the Apple ecosystem, where the much safer iCloud is available.  And indeed, as many here said and in many news reports is asked: where vaults unknowingly to msecure users in any point of time synchronised with the msecure cloud? Even if this option was disabled in the app?

Once again: no thief can do anything with ‘only’ a stolen database of hashed passwords or ‘only’ a bunch of stolen vaults. The combination is dangerous. It is deadly when msevure didn’t encrypt user master passwords at all.

But I start to have the feeling that they just see all our worries in their forums as some form of entertainment and that no one there really cares at all anymore.

The silence of msecure gave us at least a huge amount of stress, we still don’t know what to do because there is nothing we can base our actions on. Meanwhile the clock is ticking. I wish the msecure team a nice and peaceful weekend though. Sigh.

@Eltoro
both Keepassium and Strongbox seem to have been validated by the same German authority, so I think it's just a matter of understanding if the paid tool has better features, I'll test both and compare, as you're doing.
I don't sync the multiple devices "over Wi-Fi", I have saved the vault file on my NAS on a separately accessed share: the laptop has direct access to it as a regular file in a folder, while the phones connect to the NAS via WebDAV protocol (that I have enabled on the NAS). I have a strict access control to the Vault share on the NAS, checking both the connecting devices and the logon users, and adding a new client or user requires admin approval with dual factor authentication via an authenticator app, so nobody can get access to the WebDAV connection even if they get access to my home network. Of course, nothing is unbreakable, but this is as far as I can go without becoming impractical to use.

If nothing else, we ignored users perhaps could at least help to suggest fixes.

This is my suggestion for fixing the mSecure website... on the page which lists all the features

There is their answer we all have been waiting for, so non-cloud users are safe.

@Ron Actually, this is not a global broadcast and does not add anything to what they already replied to all the users who contacted the support: "Please note, this issue only pertains to users that were synching with the mSecure Cloud.". 

I think an official, global email should be sent to ALL USERS in order to clearly and exaustively describe who has been affected.

@Maurizio

I have to agree.

I have to say that the team at mSeven has right royally screwed the pooch with this. So, they'd rather drop a response that we've all been looking for into a Facebook comment, rather than clearly communicate via email, or through these forums, or through public statements with their customers, past and present. 

This will become a case study in how not to do crisis management as a business.

Had they come out with something a couple of days ago, then I - and by the look of it, a lot of others - wouldn't have spent time researching and moving their information to competitor solutions.

It's a shame, as I've always advocated the use of mSecure. It is now impossible to do that. And it's less about the breach; it's more about the fact that mSeven has undermined my trust in them. When I read the posts here (and on Facebook and elsewhere), that's the impression I get from a lot of other people.

Hopefully, the mSeven team will learn from this, and in their next business they won't make the same mistake,

I understand the frustration. I have been using mSecure since 2013 and have over 1000 items saved in mSecure, Including SSN’s and other sensitive data that cannot be changed.  However, I personally believe it would be a major mistake to switch Apps right now.

I am a retired network security professional. I have investigated many compromises over the years. One thing that is common is the company reaction after the dust settles. A company that experiences a security breach is more likely to make changes to prevent another incident.  Companies that have never had a security incident are not necessarily more secure, they are just lucky.  Eventually, almost everyone will.  

I agree the communication from mSecure could have been better, but many companies keep the incident quiet until they send out notifications 6 months after the data was stolen. mSecure did take immediate action to let us know something had happened, even though they were still investigating it.

@Mary

Absolutely true also. It is why I still give them the benefit of the doubt. And maybe they were indeed too early to sound the general alarms. Because when you do so, explanations are demanded. Obvious. The mistake they made was, the initial advice to every single customer to change all passwords etc. That was a bit too much. Probably in the extreme early fase when too many things were unclear, panic and all. Now it already turns out it affects msecure cloud users only. And I think it will turn out to be not all of them either.

Bottom line is, that now that msecure DID disclose the leak, they either should have spilled all the guts they know (which is risky because it can be very informative for hackers too). Or they should have mentioned (also and especially in these exploding forums) with some regularity what is known. Now speculation took over. That’s never a good thing, for no one involved,

I finally received a response from mSecure to my support ticket. It was essentially the same standard response posted on this forum. 

The most useful clarification was:

"Please note, this issue only pertains to users that were syncing with the mSecure Cloud. You can check this via your syncing settings (in settings)."

@lain

That indeed is the golden question where everyone is wanting an answer on, desperately. Do not understand why they can’t or want to clarify this. I ASSUME that at the moment one stops syncing with their cloud, all data and all synced vaults are deleted. Under EU law that is even obligatory. But no one knows for sure unless stated clearly once and for all,

If it’s NOT deleted, it is vital to be able to check if someone ever accidentally synced to their cloud. And if ever synced - by accident or on purpose - what files were left behind. And what exactly leaked to the great wide open.

Maybe they simply don’t know (yet), hence the external company working for them now. But some basic info regarding these burning questions is needed. Or at least a clear statement that they simply don’t know yet.

Having said that, msecure cloud users seem to be in some kind of trouble, the rest not or at least much less so.

@Mary

Your observations are well made and very balanced. It may well be that mSeven will learn from their mistakes and make changes that make their systems more robust. I hope they do.

However, whilst technically it is mSeven that has suffered the breach, the reality is that it is their customers who have had their data compromised. Understandably, those customers are following the example of those companies that you describe who review and make changes after a breach.

In this case, changing apps actually makes a great deal of sense. 

mSeven themselves, in their article on choosing a password manager, recognise that trust is one of the most important aspects in the decision process. Unfortunately, the way that they have (not) communicated is a massive breach of that trust. For many, that alone is a reason why many of their customers feel the need to move away from mSecure.

That is not the only reason, though.

Like you, I have been an mSecure customer for a very long time, and have used mSecure for storing not only passwords, but also a lot of sensitive items that cannot be changed, or can only be changed with great difficulty. I have, I suppose, become lazy. Need something stored 'safely' ... just chuck it in mSecure.

Yet mSecure has a fundamental design flaw. 

There are items that I need on the move - passwords to commonly accessed websites, for example - and there are others where I need them only in extremis, such as bank security questions. The single vault design of mSecure is poor here, with any multi-vault design apparently requiring the use of the mSecure Cloud. Yet the very essence of this is that these most sensitive items are the ones that should absolutely NOT be stored on a cloud, especially a cloud which is naturally such a honeypot for bad actors.

The wake-up call for me of this breach is that I need to review my strategy for storing secrets. And when I looked at what I really needed, mSecure just comes up short.

Reviewing the competitors shows a number of key features that just come out of the box, such as

Multiple vaults

Hardware key 2FA

Offline only storage

Use of more robust, modern  password key-stretching algorithms

Transparency

Independent security auditing

This is, possibly, paranoia, but I loathe the fact that trying to change the master password requires an internet connection, and that there is traffic to and from mSeven's network. Sure, they may not store the password. Sure, they may not even receive the password. But it doesn't feel right, and it was a joy to fire up (in testing) a number of other password managers that operate completely offline, and more importantly even when they do offer syncing - using local-only mechanisms - they run perfectly without a connection to the internet.

This means, for example, that I can keep account recovery keys separate from the normal login credentials, and critical but infrequently used passwords - such as  for accessing my domain registrar, or the mail administrator account for my email system - isolated from daily-use passwords that are carried on my iDevices. And I can set up a shared family vault for my wife and I to use for the mundane stuff, such as controlling our vehicle recharger, looking at our solar stats, etc.

So you are absolutely correct in your assertion that, after a breach, a review is often done and things improved.

The downside for mSeven is that, in doing that review, I have reached the conclusion that they just don't cut the mustard anymore. Their offering simply doesn't stack up against their competitors, who offer a broader range and more flexible approach to securing secrets.

And that's without the damage to the trust that they have caused with their very poor communications strategy.

The review has been painful. I shall miss mSecure. I hope mSeven do, indeed, survive and learn from their mistakes and make their product better. But if they want to, they have to get with the programme and start communicating properly with their customers. Otherwise it will be too late for them, because the trust will be gone, and they'll never get it back.