Important Security Notice 2026-11-03 : mSecure Support

M

Matthew

started a topic 1 day ago

This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing. This will require a triage.

re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use?

all passkeys that I use on devices that has msecure installed?

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

R

Ron

said about 3 hours ago

@Klaus, @Ben

Is there some way to ‘prove’ this as an official response…? Not that I don’t trust you, but in cases like these you can’t trust many ;-)

It for sure is THE answer people that disabled the dreaded msecure cloud and never used it are waiting for. Completely ununderstandable that this is not shared on msecure’s website. I am under the strong impression that the maker(s?) don’t even read these forums at all.

Incredible amateuristic and a textbook example for the books regarding how to NOT handle a problem in your company. Silence is killing your product, whatever it is.

Barb

said about 3 hours ago

Another thread in this forum shows a user receiving a response from mSecure after submitting a ticket. I submitted a ticket earlier yesterday and haven't received a response. They say this only affects people who were syncing to the mSecure Cloud. They also said deleting your data won't do anything (probably their way to hold on to customers). We moved off mSecure as of yesterday. Unacceptable.

C

Corrado

said about 2 hours ago

Hello everyone, I sync through Dropbox, and after mSeven's support reply I have asked them the following questions in writing. I am sharing them here in case others have the same concerns. 1. Are Dropbox sync users really not affected? An mSecure account has been required since version 5 whatever the sync method, so are account records involved? 2. What kind of information was in the stolen database? For example, email addresses, account details, or vault data? 3. In general terms, how well protected is that information, and could the unauthorized actor realistically read it? 4. What is the basis for "no evidence of access"? Is it a confirmed finding or only that nothing has been found so far? 5. When did the unauthorized access occur, and is the incident fully contained with its cause fixed? 6. Should we expect phishing or fraud attempts? If email addresses were taken, how can we tell that future messages really come from mSeven? 7. Will mSeven publish a public statement or security bulletin, and share the results of the independent review? So far the notice has reached us only by email, and many users could not verify it elsewhere. Until these are answered, many of us are left deciding whether to replace payment cards and change hundreds of logins. That costs real money and time, and it is hard to justify without clear information. If you have received answers from support on any of these points, please share them here.