Chat support available. Click the chat icon on the bottom right corner to start chatting with us right away!

mSecure Support

Knowledge Base Forums Submit a ticket
Discussions > General > Off-topic
Start a new topic

Security breach

WTF, mSecure!  Seriously, your notification about the breach is woefully unhelpful. So the current rumor is this only affects those that were syncing to your cloud...is this true? I have over 700 records containing credit cards, social security numbers for aging parents, passwords to banks, etc. Are you seriously telling is we need to change all the passwords, kill/reopen credit cards, bank accounts??!! Regrets, thoughts and prayers just doesn't cut it anymore....

Here is the response I received late last night from mSeven Support.


Yesterday, mSeven Software (“mSeven”) learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application. Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.

In immediate response to learning this information, out of an abundance of caution and in the interest of candor, mSeven notified current and former mSecure customers and provided as much information as was reasonably available at that time.

As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices. However, as stated, the database involved was encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

We have taken steps to bolster security to help prevent future unauthorized activity. Unfortunately, deleting mSecure will have no impact on this situation. However, as stated, the database that is involved is encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

Please note, this issue only pertains to users that were synching with the mSecure Cloud.

mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use. Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support.

 

It's the login that really kills me.  I mentioned that using a master password to log into the software, as well as using it to log into msecure.com was a bad idea---and msecure was furious with me.  Someone went into a email diatribe at me about verifying accounts and people using licenses past what they were paying for.  Soooo---were those master passwords stored?   Was the money worth it, msecure?  Because now you're looking at a tremendous legal challenge if you don't become more forthcoming about what customers are dealing with.  Was the "access" to msecure cloud truly just access to encrypted accounts that can't be opened?  Or did you store master passwords?

Agreed that the original email was unhelpful and that Mseven does not seem to be taking this seriously enough. Most sites offer identity protection monitoring at the very least when something like this happens. I have hundreds of passwords on the site and have for many years. Only a dozen or so of them could be used to cause me real harm. Banking and investment accounts are first to mind. 

I don’t want to spoil the party for those who are not on the mSecure cloud but.., I am on iCloud synch and two hours after I received the mail from mSecure, my bank called me to say there had been unauthorised use of one of my credit cards. Could be coincidence but last time I had a credit card unauthorised access was 30 years ago. Once I have access to my account again, I will check the details of the event and see if there is another explanation but meanwhile I would be cautious with assuming it’s limited to mSecure cloud only.

the more serious question here, that I have raised my email and others have mentioned, is the master password and its associated technology.. we need to know if this has in any way been compromised in this breach.. if the actors have only the encrypted data the risk of them accessing it is low, at least for the time being.. but if the master password is in any way compromised then suddenly the risk is very high. 


Some steps I think we should all take NOW


Prioritise your risks.. and change passwords for the high risk accounts TODAY, and turn on 2FA authentication wherever you can

Make sure you use a different authenticator solution.. I have kept 2FA authentication away from Secure for precisely the risk we are looking at here

Take steps to register to protect your core identity if available in your country - CIFAS in the UK costs £30

Monitor Credit reference Agencies for suspicious activity

There are a lot more steps if this is a worst case breach.. cancelling cards, accounts, passports and other Identity documents to name just a few.


Then we should all ask how we will be supported to monitor and protect our identity 



Login or Signup to post a comment