This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

Given that the company has gone completely dark I wonder if their lawyers might be telling them not to admit any further liability publically? The silence and no attempt at damage control is ominous indeed. 

Ok, 14 hours after the start of the ‘incident’. The news had broken worldwide now, all over tech sites. Still not a single reply from the devs. It means we have to take a worst case scenario in account. Namely, that the app itself is compromised, and we have to face the fact that there possibly was a backdoor in that. Maybe ‘intentionally’ for support reasons (still of course a no go for a security app that pretends to work local only). This feeling is amplified by the test I did a few hours ago, trying to change the LOCAL master password WITHOUT any network connection with the app. It led to an error stating the password couldn’t be changed because it couldn’t be uploaded to the msecure server. All that, while msecure-syncing was disabled, local only storage etc.

msecure is history by now. They could have a avoided a bloodbath for both themselves as well as their customers by simply explaining WHAT was the problem, WHICH (type of) users were affected. None of that. Which points more and more to an app level breach. Many security aware users (both private and business) chose msecure specifically for it’s local only approach. IF they would have stuck to that, there would have been no problem at all. It would have meant that this app would have needed no internet access at all and it could have been 100% secure, only depending on a LOCAL master password.

Sadly, it means that every time you even start this software there is a high risk of abusers grabbing their chance. Changing passwords WITHIN msecure is useless, especially since we don’t know what precisely is going on.

Nobody at the msecure team feels any obligation to clarify things, they don’t even write that for legal reasons they can’t. Big chance that this office (living room, attic, garage) is already emptied, and all traces of a grave human error wiped out. Consider msecure gone by now. Never saw this behavior of a software team ever before in my (long) IT-life. Maybe they had a criminal team member on board, maybe their intentions changed over the years. We’ll probably never know.

Anyway, the general consensus in several news reports is simple: consider the msecure app  unsafe regarding the silence of the developers. Every single piece of data within its ‘encrypted’ database can be considered as compromised. Changing passwords within the app itself is useless.

Given what has been communicated, the ensuing silence and the magnitude of the potential liabilities, I would not be surprised seeing this company fold.

There is another theory...  They are no longer working on the project or are on holiday. 
Seems there are two possibilities here
1) They are on holiday and we're all freaking out simply because someone broke into their PHP driven email server and used ChatGPT to write that message (which someone elsewhere showed it was an AI message)
2) The app was using a compromised library and sending the unencrypted data out to a bot farm.
With no response from msecure yet I think we have to work on it being #2 and assume everything in the cloud AND local store are compromised if you opened the app recently.

The evidence it is likely #2 is that the app was updated 23rd Oct 2026 and included recent new features, no doubt including libraries that could be compromised like just like most smart tv's were a few years back.

The evidence it is possibly #1... the website has not been updated, there has been no post to Twitter saying the email is legitimate.  They haven't disabled/deleted this forum where people are speculating and will no doubt be damaging their brand in future search results.

I mean out of courtesy they should at least say on twitter if the email is legit. 

So this is either a 'meh' security moment with email server issue, or a what an absolute mess and everyone is compromised.  

mSecure, please tell us if that email was legitimate!

@Stuart

Them having holidays is a below zero chance. They were never very communicative. I think it’s a very small team, or one person. They chickened out after this shitstorm which will of course have serious legal consequences for them. The chance is growing that they left the sinking ship and we will never hear anything ever again from them. They stated and promised things in their product features that are simply not true. The writing was on the wall already a while ago when a German security audit showed flaws and the fact that msecure DID have access to user data and possibly the encrypted database. Also to the questions of the researchers, they never responded up to this day. It starts to sound fishy and one can wonder with what intention this app was created in the first place :-(

In similar security breach incidents I’ve been involved in, the affected company was instructed not to comment while insurers and incident response specialists handled the situation. Something similar may be happening here.

That doesn’t excuse the lack of useful updates, but it may explain the silence.

Personally, I’ve spent all day changing passwords for critical accounts and moving to a different password manager. With no clear explanation of what happened, whether the issue is contained, or when we can expect answers, that felt like the most sensible way to protect my accounts while retaining the convenience of a password manager.

I have been collecting user reports, although these are obviously unverified:

1. Inability to change their master password (i.e., the cloud).

2. Inability to cancel their subscription (i.e., the cloud).

3. Inability to access data via the web (i.e., the cloud).

Does anybody have their own to share so we can attempt to piece together the extent of this incident ourselves?

@Trevor

Problem is, that for business users it will be much, much more than a day. You’ll also have to deal with possible client exposures etc. Precisely that is why msecure should at least explain WHO is affected. Is it their cloud, a huge app leak, an internal leak of user data with or withoud encrypted databases? We have the right to know and they have the legal obligation to explain. I gave it the benefit of the doubt the first few hours (already being very generous).

But now we are getting extremely p***ed off. It sounds extremely unprofessional. And probably that’s precisely what it all was from the beginning on: a solo hobbyist who made a secure app (or at least thought he did). The curse of present-day apps and software in general: it can be made by anyone, anywhere. Professionalism isn’t  derivable anymore from a pro-looking website, or a roaring description and impressive list of feats. It’s just gambling for everyone in the industry nowadays, hit and miss.

Better use a good old fashioned locally stored and encrypted excel-sheet with all your passwords and other sensitive data. Much more cumbersome, unfortunately. But trusting security apps made by who knows is not of this century anymore.

+1 to all the things being said. This is unacceptable that we're this far into this massive of a security breach without any real information. mSecure team all gone home and closed the doors?!!!!

@Roger

Good initiative, but without any REAL and dearly needed information from msecure that list is all we know at the moment. 15+ hours without information in a large scale security breach is unprecedented in the security industry. It’s a potential goldmine for criminals. I still have fading hope that app-users with local database storage are not the ones affected. But we need a clear confirmation about that. Msecure went dark though, we reached the point we can assume it’s lights out there.

Still nothing from these guys? This is criminal at this point. I think saying I feel angry is an understatement. 

I have switched to wifi sync as apparently it deletes your data on Msecure servers (I hope). Any suggestions alternate password managers, I am looking at Nordpass as it is included in my VPN subscription any thoughts ?  Considering the lack of information and any response to our requests I will be canceling my subscription with msecure.

I am not an employee of MSeven.  However, having worked in IT and experienced a data breach, I would think MSeven is actively trying to understand the method used to break in, block access to the bad actor and ascertain what info was stolen.  That is their primary focus.  It may take them a few days to collect more accurate information.  

The first people called after these incidents are typically cyber insurance company lawyers specializing in data breaches. Those lawyers will likely suggest the company get the word out to their customers with the maximal possible consequences (change everything) because if they don't or if people misunderstand the notice and don't take action and lose money etc... MSeven could be liable.   Plus they need to keep what they know about the hack internal only, because clearly the hacker could be reading these forums.  Explaining what they know could alert the hacker if they are close to finding them or how they could possible modify the attack to continue stealing data.  

The ecosystem around Msecure is complicated.  There are many ways to use MSecure, if you don't share any info with MSeven, (offline user only, no web browser extension, backup and sync to third party Dropbox, iCloud, etc...) you might not be impacted.  However others who have an account setup online might. It's hard to know and non-technical customers would have no way of knowing.  If the Msecure app code itself was modified by a hacker and deployed then everyone and every secure record is at risk.

You may never get a straight answer from MSeven, or they may provide more information.  Without more information they will lose all the trust customers have in their product.  This could mean the demise of the company, so they may release more information.  It's hard to tell.  I am sure the company senior executives are having these difficult discussions already with their lawyers and financial backers.

I would suggest that everyone change their master password and prioritize changing passwords for financial institutions, primary email accounts and high value accounts.  

@Puneet, the grok answer given above is great.  It would be even better if you also posted the query you used, so that we know the specific criteria used to generate that answer.  

Would you be so kind as to also post that query?