Just thought I would put this out there. Hopefully there are some software security people who can confirm or deny.

Allegedly, the files stolen are the sync files for those of us who sync over the cloud to multiple devices. Which I do darn it.....

From everything I understand, these files are AES 256 bit encrypted and from what I have read, is almost impossible for a bad actor to decrypt without the users key or user ID and password. Since the encryption allegedly cannot really be broken, then do we need to be worried?

Also, msecure servers do not have our passwords or the encryption key. That only exists on our own computers or phones. So the bad actor could not have gotten those from msecure. 

This is of course directly stated on their website and one of the reasons I went and stayed with them.

MSECURES LANGUAGE.  (mSecure uses advanced AES-256 encryption to safeguard your sensitive information. With zero-knowledge architecture, only you can access your data – not even mSeven Software can access it, since we do not store your account password or account key on our servers. Cloud and Wi-Fi sync, backup and recovery, biometric unlock, and auto-lock settings ensure complete protection across all your devices.)

So from a technical standpoint, is it almost impossible that our data would be at risk?

Of course I can understand how msecure is responding with vague words and encouraging changing everything. Sounds like their lawyers talking. 

What do you smart people think of this?

My thoughts, based on responses from mSeven that others have posted here, are that you are on the right track, Mark.  It sounds like the bad actor has obtained an encrypted copy of their cloud db, which likely contains encrypted copies of user vaults.  In order to obtain usable credentials they would first have to decrypt the database and then decrypt individual user vaults found inside.  Encryption used is so far still secure.  So the exposure risk as of today is minimal.

However, technology continues to advance.  There is a known risk of what's called harvest and decrypt.  This one is coming for everyone using current encryption technology, regardless of who's products they are using.  It is anticipated that sometime within the next ~ few years, that quantum computing technology will advance to the point where it will be able to crack current encryption methods.  When that day arrives, Mr. Bad Actor if he still has the mSecure db, will be able to break the db encryption, and then proceed to break the encryption of the vaults contained therein and begin to see what data contained therein is interesting to take advantage of.

Because of this future risk, mSeven has to advise us all to change our passwords now, because let's be honest, if we don't do it now will we still remember this day in 3-5 years or so and think "Yeah, time to go change those passwords that I never got around to changing in 2026"?

Also, there are experts in the field working on developing standards for new post-quantum cryptography (PQC) encryption standards to replace current encryption standards.  You can try to read up on this topic if it doesn't make your head spin.  As a slightly more approachable way of keeping an ear to the ground I would recommend a podcast called Root Causes.  It's jargon-heavy as well, but it's useful to at least know what's going on, key dates, what changes are being made by major vendors, etc.

AI is busy hacking into anything and everything.  That's why we need all these datacenters in my favorite farmland!  (didn't anyone see the movie ??)

I'm grandfathered from the version 4 days, and although everything looks OK now, I'll be back to syncing to my laptop and home NAS like it was in the old days.  I don't make that many changes so frequently that I can't sync it up at home.

#AirGap  #Rolodex 

Just have to remove my sync from the mSeven cloud.

Yeah, I already turned sync odd off too. But I was hoping to get peoples reaction to the idea that it may be almost impossible for a bad actor to actually decrypt an AES 256 file. 

Very good and thoughtful comments Mitch. We are overseas now, but I will strongly consider changing all of my hundreds of passwords.   Darn....

However, if what you say is true that future advances will allow people to break the AES 256 encryption, then we should do as Andrew suggests and just stop syncing......which is very convenient...but of course not totally necessary. The syncing that is......