Keep an eye out for an update to the various MSecure apps, apply them ASAP.  If there is no update for the Msecure app on your platform for quite some time, then offline users can feel more comfortable that they may not be impacted.

I have an essentials account so I can not implement 2 factor authentication.  Do you recommend I pay for the premium plan?  Will it implement right away so I can set up the 2 factor authentication.  I was one of the original msecure account holders so came from msecure 5 (and earlier).  Thanks for your help.

There is already a thread open here - no need for duplicates: 

https://support.msecure.com/en/support/discussions/topics/36000038998

Why did OP create a new one under Feature Request? Think first next time. 

This is an extremely unprofessional action of msecure. If indeed it is true that someone with malicious intentions was able to break in an app running on unmodified iOS, iPadOS or macOS that is breaking world news. We are extremely worried because there is no information at all about what PRECISELY happened. We store hundreds of passwords in the app, for obvious reasons ONLY running local. No cloud back-ups, no msecure online. Besides, there are also credicards, passports nd many more extremely privacy sensitive data stored within this app. If that all must be replaced, we assume the bills can be send to msecure?

In essence as long as msecure not informs us clearly about what happened, how it happened and who is affected it spunds wise to remove this app from all systems. All alarmbells went off here, both private and business wise.

WE HAVE THE RIGHT TO KNOW WHAT IS GOING ON. A mail with instructions to simply change all passwords, pincodes (not even possible) etc is ridiculous.

The deafening silence is extremely worrying, maybe this is a one-person company???

No need for a lecture from you, Phil.

Laughable that some here are attributing lack of response to hour of day in Oregon.  If this compromise is true, then the sole programmer must have fired off an email to users and then made some warm milk and went to bed.  Are those of us non-paying users of the app SOL?

I have changed my master password and, as suggested by others, prioritised logon credential changes, including 2FA where not already implemented, for my critical accounts.

Interestingly, I cannot access my mSecure data via a web session- the message says I do not have an active subscription plan. Maybe that's a part of their lockdown/firewall while investigating. The mSecure app on my iOS devices works normally.

Finally, I have submitted two tickets: 

• One for the suspect email and 
• a second for the 'no subscription' error. 

This poor and unsettling experience makes me inclined to go elsewhere, like Proton Pass.

Stuart, I have had the exact same experience as you.  I asked about exporting mSecure data to .csv as well, as I am teeing things up to move to BitWarden.

Looking for more information like everyone else.....

Can you please turn on the Premium edition for all while we try to clean up this mess, just got blocked by the app when I was trying to do some filters.  

Been 9 hours looking for some real information

Given the wording in your "security notice," define "recently."

We can't react with our own triage without more details on the "suspicious activity".  The possibilities seem to range from very minor to catastrophic for those of us who have relied on mSecure for years.  It would be extremely helpful to know if we are all calling our credit card companies and visiting our financial institutions to transfer accounts!  The last time I worked through a major breach (not an mSecure breach), it took almost a week to update all of my passwords.

I've reread your security protocols and it seems that actual, visible data on mSecure servers may be extremely minimal and encrypted.  But we need that confirmed.  We need to know the impact to those users who are not using the mSecure cloud sync (i.e. iCloud , Dropbox, Wi-Fi) so we can determine the most critical path for our data.  I realize you may still be trying to determine the true extent of the incursion - but you NEED to update your advisory plan to provide more specifics so we can all react accordingly.

Starting to worry about a worst case scenario: an undocumented ‘service entrance’ to the app that could give msecure access to all user data. Or even worse: despite promising us local storage only, sneakily copies of the database were made to msecure servers. Why?